CVE-2023-49105

    Dashboard / Vulnerabilities / CVE-2023-49105

    CVE-2023-49105

    Published: 21 Nov 2023Last Modified: 30 Aug 2026

    Summary:

    Details: An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.

    References: https://owncloud.org/security, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49105.json, https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor, https://nvd.nist.gov/vuln/detail/CVE-2023-49105, https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 94282d9471e5c786602af512e7207aed6b6e3f8f
    Fixed -d06b1d870377662dd9ff327485acc2d3e1991bcb

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-49105 | CVE-DB