CVE-2023-25150

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users files. It is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextcloud 24), 5.0.10 (Nextcloud 23), 4.2.9 (Nextcloud 21-22), or 3.8.7 (Nextcloud 15-20). There are no known workarounds for this issue.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Feb 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-251517.5opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentaCVE-2023-251528.8Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and direCVE-2023-251535.5containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the nuCVE-2023-251546.1Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appeCVE-2023-251556.5Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDCVE-2023-251569.8Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt bruCVE-2023-251579.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support CVE-2023-251589.8GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression languagCVE-2023-251595.3Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaborCVE-2023-25165.4Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.CVE-2023-251605.3Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can CVE-2023-251615.3Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise S