ownCloud vulnerability

[fuzzybear]

Hi there,

I have read here that there are new known vulns with ownCloud - do we need to be concerned about this?

Thanks

[SysKeeper]

Do the recent OwnCloud CVE also affect Nextcloud?

The 3 vulnerabilities are: WebDAV Api Authentication Bypass using Pre-Signed URLs - CWE ID: CWE-665 Subdomain Validation Bypass (oAuth2) - CWE ID: CWE-284 CVE-2023-49103

[fuzzybear]

Apologies, I’m not sure from your response as to whether this involves Nextcloud or not

[sven1234]

You should follow the link.

[fuzzybear]

Ha, sorry, reassuring to see all ok

[tflidd]

There is also an official clarification:

Security statement

Originally published at: Security statement on ownCloud breach - Nextcloud We are receiving information requests from customers and users worried about the severe security breaches. These occurred in ownCloud (recently aqcuired by US file sync and share vendor Kiteworks) as reported on by Arstechnica and others. We want to make clear that these absolutely do not affect Nextcloud. Nextcloud has a strict security process backed by a USD 10K bug bounty program. We, for example, have a policy…