CVE-2023-28833

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted and could overwrite files in the appdata directory. Administrators may have access to overwrite these files by other means but this method could be exploited by tricking an admin into uploading a maliciously named file. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should avoid ingesting logo files from untrusted sources.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Mar 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-288344.3Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as NextcloudCVE-2023-288357.5Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share wasCVE-2023-288365.4Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a storedCVE-2023-288374.9Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in WaCVE-2023-288388.1GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vCVE-2023-288399.8Shoppingfeed PrestaShop is an add-on to the PrestaShop ecommerce platform to synchronize data. The module Shoppingfeed for PrestaShop is vulCVE-2023-28849.8Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allowCVE-2023-288408.7Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various oCVE-2023-288416.8Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various oCVE-2023-288426.8Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various CVE-2023-288439.8PrestaShop/paypal is an open source module for the PrestaShop web commerce ecosystem which provides paypal payment support. A SQL injection CVE-2023-288446.5Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can stil