CVE-2023-49792

CVSS 3.1 Score 5.3 of 10 (medium)

Details

Published Dec 22, 2023
Updated: Jan 3, 2024
CWE ID 307

Summary

CVE-2023-49792 is a vulnerability that affects Nextcloud Server and Nextcloud Enterprise Server versions prior to 26.0.9, 27.1.4, 23.0.12.13, 24.0.12.9, 25.0.13.4, and 27.1.4. When a trusted proxy is configured, the servers can be tricked into reading an incorrect remote address for an attacker, allowing them to execute authentication attempts that were not intended to be permitted. The issue has been patched in the mentioned versions of Nextcloud Server and Nextcloud Enterprise Server, but no known workarounds are available at this time. The vulnerability poses a medium risk with a base severity score of 5.3 according to the CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Note: The information provided is based on the given text and does not imply any personal opinion or endorsement of the described vulnerability or affected products/services.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-49792 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options