CVE-2023-24804

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. The bypasses may lead to information disclosure when uploading the app’s internal files, and to arbitrary file write when uploading plain text files (although limited by the .txt extension). Version 3.0 fixes the reported bypasses.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Feb 13, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-248058.8cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other tha CVE-2023-248077.5Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regu CVE-2023-248086.5PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdf CVE-2023-248095.5NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call)CVE-2023-24817.5Compiler removal of buffer clearing in sli_se_opaque_import_key in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key CVE-2023-248106.1Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during `miauth` authentic CVE-2023-248116.1Misskey is an open source, decentralized social media platform. In versions prior to 13.3.2 the URL preview function is subject to a cross s CVE-2023-248129.8Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient pa CVE-2023-248139.8Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can CVE-2023-248146.1TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 c CVE-2023-248155.3Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications t CVE-2023-248167.0IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Py