// For flags

CVE-2023-22469

Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache

Severity Score

3.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached data of a user that has access. There are currently no known workarounds. It is recommended that the Nextcloud app Deck is upgraded to 1.8.2.

Deck es una herramienta de organización estilo kanban destinada a la planificación personal y organización de proyectos para equipos integrada con Nextcloud. Al obtener la vista previa de referencia de las cartas de Deck a las que el usuario no tiene acceso, un usuario no autorizado podría eventualmente obtener los datos almacenados en caché de un usuario que tiene acceso. Actualmente no se conocen workarounds. Se recomienda actualizar la aplicación Deck de Nextcloud a 1.8.2.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-12-29 CVE Reserved
  • 2023-01-10 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-02 EPSS Updated
  • 2024-08-02 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-922: Insecure Storage of Sensitive Information
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Nextcloud
Search vendor "Nextcloud"
Deck
Search vendor "Nextcloud" for product "Deck"
< 1.8.2
Search vendor "Nextcloud" for product "Deck" and version " < 1.8.2"
-
Affected