CVE-2023-35171

    Dashboard / Vulnerabilities / CVE-2023-35171

    CVE-2023-35171

    Published: 23 Jun 2023Last Modified: 12 Aug 2026

    Summary: Nextcloud Server vulnerable to open redirect on "Unsupported browser" warning

    Details: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known workarounds are available.

    References: https://hackerone.com/reports/1977222, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35171.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h353-vvwv-j2r4, https://nvd.nist.gov/vuln/detail/CVE-2023-35171, https://github.com/nextcloud/server/pull/38194

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 62cfd3b4c9ff4d8cdbbe6dcc8b63a1085bb94e3d
    Fixed -053cefa373ab62edce8bb69fcfc0d6a5ee6fc3f9

    Affected versions

    v26.0.2rc1
    v26.0.1
    v26.0.1rc1
    v26.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-35171 | CVE-DB