Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-22471

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2.

Published

2023-01-14T01:15:14.163

Last Modified

2024-11-21T07:44:52.347

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 3.5 (LOW)

Weaknesses

Type: Secondary
CWE-639
Type: Primary
CWE-639

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	nextcloud	deck	< 1.6.5	Yes
Application	nextcloud	deck	< 1.7.3	Yes
Application	nextcloud	deck	< 1.8.2	Yes

References

https://github.com/nextcloud/deck/pull/4173 Patch, Third Party Advisory ([email protected])
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vw5-pfg6-3wm6 Third Party Advisory ([email protected])
https://github.com/nextcloud/deck/pull/4173 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vw5-pfg6-3wm6 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)