CVE-2023-49103: own Cloud Critical Vulnerability Quickly Exploited in the Wild | Grey Noise Blog
Summary: On November 21, 2023, ownCloud disclosed CVE-2023-49103, a critical vulnerability rated 10 out of 10 in the "graphapi" app, present in versions 0.2.0 to 0.3.0, that lets attackers access admin passwords, mail server credentials, and license keys through a third-party library exposing PHP environment configurations. GreyNoise observed mass exploitation in the wild as early as November 25, 2023, and noted that disabling the app does not entirely resolve the issue and that non-containerized instances are also at risk.
Key Takeaway: Exploitation began within days of disclosure, and the exposed data includes admin passwords and mail server credentials, so rotating every secret the app may have touched is part of the response, not an afterthought. ownCloud also disclosed an authentication bypass (CVE-2023-49105) and an oauth2 flaw (CVE-2023-49104) alongside it.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-49103CVE-2023-49104CVE-2023-49105
- Related
- CVE-2023-49105: own Cloud Improper Authentication Vulnerability Known Exploited Vulnerabilities · Aug 27, 2026CVE-2023-49103: own Cloud graphapi Information Disclosure Vulnerability Known Exploited Vulnerabilities · Nov 30, 2023