CVE-2023-48306
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2023-48306 is a vulnerability affecting the Nextcloud Server, which is used for data storage in the open-source cloud platform Nextcloud. Versions 25.0.0 and prior to 25.0.11, as well as versions 22.0.0 and prior to 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server are impacted. The issue stems from a vulnerability in the DNS pin middleware, which can be exploited for DNS rebinding, allowing attackers to execute Server-Side Request Forgery (SSRF) attacks. Patches for the vulnerability are available in Nextcloud Server 25.0.11, 26.0.6, and 27.1.0, and Nextcloud Enterprise Server 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0. No known workarounds are currently available.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Nextcloud Server
Affected Vendors
- Nextcloud GmbH
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions