CVE-2023-35171

Katalog CVE

CVSS 6.1 · Medium EPSS 0,59%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada nextcloud server. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known workarounds are available.

Rincian

Terbit di NVD

23 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h353-vvwv-j2r4 exploit · issue tracking · advisory vendor
• https://github.com/nextcloud/server/pull/38194 issue tracking · patch
• https://hackerone.com/reports/1977222 exploit · issue tracking · mitigasi · advisory pihak ketiga