.webp)
A vulnerability was discovered in ownCloud, a tool used to share and sync data collaboratively, classified as CVE-2023-49103. MITRE has designated this vulnerability with a CVSS score of 10.0. It is related to the graphapi portion of the application. Because the graphapi relys on a third-party library to provide a URL that contains the phpinfo, the viewing of sensitive data such as ownCloud admin password, mail server credentials, and license key is allowed.
Access to the phpinfo can potentially allow sensitive details to be discovered by an attacker which can be used to gather information about the system. The impact of this vulnerability on the environment is directly related to the information stored in the phpinfo file. This information could include passwords, credentials, and a license key according to ownCloud.
If the user had installed ownCloud on a docker-container before Feburary 2023, they are subject to the vulnerability, otherwise they are not.
The affected product is the graphapi, versions 0.2.0 - 0.3.0.
It is necessary to review your organization’s tech stack to determine if ownCloud is used. If so, apply the mitigations recommended by the vendor.
ownCloud has not provided a patch but has provided instructions to mitigate this vulnerability. This involves deleting the file “wncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php”. ownCloud has reported that they have disabled the phpinfo function in docker-containers and will be applying various hardening methods to mitigate similar vulnerabilities in future releases.
They also recommend changing the following:
Follow vendor recommendations: Due to a patch not being available applying the vendor mitigations/workaround will prevent this vulnerability from being exploited. This includes deleting the GetPhpInfo.php file and changing the secrets mentioned above.
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
