CVSS 3.1 Score 8.7 of 10 (high)


Published Nov 21, 2023
Updated: Dec 1, 2023
CWE ID 601


CVE-2023-49104 is a vulnerability discovered in ownCloud owncloud/oauth2 before version 0.6.1, specifically affecting the product JVczJj. The vulnerability allows an attacker to bypass validation by passing a crafted redirect URL when the "Allow Subdomains" feature is enabled, enabling them to redirect callbacks to a Top Level Domain controlled by the attacker. The vulnerability has a base severity rating of HIGH with a base score of 8.7 according to CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. The potential danger posed by this vulnerability includes high impact on integrity and confidentiality, with no privileges required and no user interaction needed for exploitation. Remediation for this vulnerability would involve updating ownCloud to version 0.6.1 or later to mitigate the risk of exploitation and potential unauthorized redirection of callbacks.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-49104 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options