CVE-2023-35171
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
NextCloud Server and NextCloud Enterprise Server provide file storage for a productivity platform. In versions 26.0.0 to 26.0.2, an attacker could supply a URL that redirects an unsuspecting user from a legitimate domain to an attacker's site.
Risk Assessment
Organizations may be vulnerable to phishing and other attacks that exploit redirects to malicious sites. Users may unknowingly expose their personal or login information.
Recommendation
It is recommended to update to version 26.0.2 or later to patch this vulnerability. Additionally, monitor network traffic for potential attack attempts.
Original NVD description (English source)
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known workarounds are available.