CVE-2023-28645: nextcloud richdocuments Improper Access Control
Vulnerability summary
CVE-2023-28645 is a medium (CVSS 6.5) Improper Access Control vulnerability in nextcloud richdocuments. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.9% of scored vulnerabilities.
Timeline
- 31-03-2023PublishedVulnerability first disclosed.
- 11-02-2025Last modifiedVulnerability information updated.
Description
Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app (richdocuments) is upgraded to 8.0.0-beta.1, 7.0.2 or 6.3.2. Users unable to upgrade may mitigate the issue by taking steps to restrict the ability to download documents. This includes ensuring that the `WOPI configuration` is configured to only serve documents between Nextcloud and Collabora. It is highly recommended to define the list of Collabora server IPs as the allow list within the Office admin settings of Nextcloud.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.7MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.74%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
0.00 pp
From 0.74% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Nextcloud2 products
- richdocuments≥ 6.0.0, < 6.3.2 | ≥ 7.0.0, < 7.0.2
- security-advisories≥ 7.0.0, < 7.0.2 | < 6.3.2
1 vendor · 2 products
References
3 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-95j6-p5cj-5hh5X Refsource CONFIRMMitigationVendor Advisory