CVE-2023-30539

高 8.8CVE-2023-30539 · 17/04/2023 公開 · 17/06/2026 更新

要点

CVE-2023-30539 は nextcloud files automated tagging (nextcloud), nextcloud server (nextcloud) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.63%（全脆弱性の 50.1% より高い）。
対処：1.14.2, 1.15.3, 21.0.9.11, 22.2.10.11 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
nextcloud files automated tagging nextcloud	`= 1.11.0= 1.12.0= 1.13.0= 1.16.0≥ 1.14.0, < 1.14.2≥ 1.15.0, < 1.15.3`	`1.14.21.15.3`
nextcloud server nextcloud	`≥ 21.0.0, < 21.0.9.11≥ 22.0.0, < 22.2.10.11≥ 23.0.0, < 23.0.12.6≥ 24.0.0, < 24.0.11≥ 25.0.0, < 25.0.5`	`21.0.9.1122.2.10.1123.0.12.624.0.1125.0.5`

概要

Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Server is upgraded to 24.0.11 or 25.0.5, the Nextcloud Enterprise Server to 21.0.9.11, 22.2.10.11, 23.0.12.6, 24.0.11 or 25.0.5, and the Nextcloud Files automated tagging app to 1.11.1, 1.12.1, 1.13.1, 1.14.2, 1.15.3 or 1.16.1. Users unable to upgrade should disable all workflow related apps. Users are advised to upgrade.