CVE-2023-49105 kev in the critical feed json
An issue was discovered in ownCloud owncloud/core before 10.13.1.
published 2023-11-21 2 y ago modified 2026-08-28 2 mo ago also EUVD-2023-53114
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2026-08-27
- epss
- 43.2%
- EPSS 43.2% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
Patch / fix
cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- owncloud owncloud_server 10.13.1
Timeline
- Published
- CISA SSVC: exploitation active
- Added to CISA KEV
- CISA patch deadline
Known exploited
- Added
- 2 mo ago
- Patch by
- 2026-08-30 (2 mo ago)
- Ransomware
- Not known
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Vendor, product
- ownCloud, ownCloud
- CISA name
- ownCloud Improper Authentication Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
43.19% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
owncloud.com
/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/
vendor-advisory
-
owncloud.org
/security
product
-
hunt.io
/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor
third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105
government-resource, us-government-resource
Sources
- CVE List CVE-2023-49105
- NVD CVE-2023-49105
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.