OwnCloud critical vulnerabilities already activelly attacked
Take action: If you missed the advisory and you are using ownCloud, wake up your team and start applying the workarounds immediately. Hackers are already looking for your exposed ownCloud GraphAPI to hack you.
Learn More
Security researchers have noted active exploitation attempts targeting one of the severe vulnerabilities published by OwnCloud last week.
The three vulnerabilities - CVE-2023-49103, CVE-2023-49105 and CVE-2023-49104 are ranked very high on the CVSS3 scale - 10, 9.8 and 8.7 respectivelly.
The most severe vulnerability, CVE-2023-49103,affects versions 0.2.0 to 0.3.0 of OwnCloud's Microsoft Graph API app and is linked to a third-party library that could be exploited to manipulate API-provided URLs. OwnCloud has issued mitigation instructions.
The Shadowserver Foundation, a non-profit security organization, echoed the urgency of mitigating this issue by reporting on Twitter that it had observed attempts to exploit CVE-2023-49103, stressing the ease with which this could be done.
Since OwnCloud is a publicly facing system by it's design, patching as soon as possible is highly recommended.
