CVE-2023-49105

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Aug 28, 2026

Description

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/Vendor Advisory
https://owncloud.org/securityProduct
https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/Vendor Advisory
https://owncloud.org/securityProduct
https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractorThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105US Government Resource

Timeline

Published: Nov 21, 2023
Last modified: Aug 28, 2026
Added to CISA KEV: Aug 27, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-491067.5Missing Password Field Masking vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent component).This issue affects CVE-2023-491077.5Generation of Error Message Containing Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent CVE-2023-491088.8Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 (excluding Ver.6.1.1.3a). If this vulnerability is ex CVE-2023-491099.8Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend user CVE-2023-49117.8A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This CVE-2023-491107.2When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the CVE-2023-491116.5For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on t CVE-2023-491126.5Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the CVE-2023-491137.8The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can CVE-2023-491146.7A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arb CVE-2023-491157.5MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.CVE-2023-491175.4PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arb