CVE-2023-49104

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://owncloud.com/security-advisories/subdomain-validation-bypass/Vendor Advisory
https://owncloud.org/securityVendor Advisory
https://owncloud.com/security-advisories/subdomain-validation-bypass/Vendor Advisory
https://owncloud.org/securityVendor Advisory

Timeline

Published: Nov 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-491059.8An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication CVE-2023-491067.5Missing Password Field Masking vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent component).This issue affects CVE-2023-491077.5Generation of Error Message Containing Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent CVE-2023-491088.8Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 (excluding Ver.6.1.1.3a). If this vulnerability is ex CVE-2023-491099.8Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend user CVE-2023-49117.8A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This CVE-2023-491107.2When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the CVE-2023-491116.5For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on t CVE-2023-491126.5Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the CVE-2023-491137.8The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can CVE-2023-491146.7A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arb CVE-2023-491157.5MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.