CVE-2023-35928

Summary

CVE-2023-35928 is a vulnerability affecting the Nextcloud Server, a data storage component of Nextcloud, a self-hosted productivity platform. In specific versions, including 25.0.0 to 25.0.7 and 26.0.0 to 26.0.2 for Nextcloud Server, and various versions for Nextcloud Enterprise Server, a user could exploit a functionality to gain access to another user's login credentials and take over their account. This issue has been addressed with patches in multiple versions, including 25.0.7, 26.0.2, and several others for Nextcloud Server and Enterprise Server. Users can work around this vulnerability by disabling the app files_external, setting "Allow users to mount external storage" to disabled, or preventing users from creating external storages using types FTP, Nextcloud, SFTP, and WebDAV.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.