An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.

published 2023-11-21 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-53112

cvss: 10.0; version 3.1, CNA
cisa kev: Exploited; added 2023-11-30
epss: 77.8%; EPSS 77.8% chance of exploitation in 30 days, percentile 99.5%
public exploits: 1; Metasploit, plus a Nuclei check

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Timeline

2023-11-21 Published
2023-11-21 First public exploit (Metasploit auxiliary/gather/owncloud_phpinfo_reader)
2023-11-30 Added to CISA KEV
2023-12-21 CISA patch deadline
2025-01-27 CISA SSVC: exploitation active

Known exploited

Added: 2 y ago (2023-11-30)
Patch by: 2023-12-21 (2 y ago)
Ransomware: Not known
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product: ownCloud, ownCloud graphapi
CISA name: ownCloud graphapi Information Disclosure Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

T1190 Exploit Public-Facing Application exploitation
T1005 Data from Local System primary impact
T1552 Unsecured Credentials primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: partial
Assessed: 21 mo ago (2025-01-27)

Exploit prediction

77.75% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit auxiliary/gather/owncloud_phpinfo_reader ownCloud Phpinfo Reader metasploit auxiliary, normal rank, 2023-11-21
Nuclei template OwnCloud - Phpinfo Configuration nuclei detection template

CVSS scores

assigned by	version	score	vector
CNA	3.1	10.0	CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
CNA	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

owncloud.com /security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
vendor-advisory
owncloud.org /security
product
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49103
government-resource, us-government-resource

Sources

CVE List CVE-2023-49103
NVD CVE-2023-49103

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary