🔴 CVE-2023-49105

CVE-2023-49105 is a critical WebDAV API authentication bypass in ownCloud core (versions 10.6.0–10.13.0) that allows an unauthenticated remote attacker to access, modify, or delete any user's files using pre-signed URLs when the victim's username is known and no signing-key is configured. It is CVSS 9.8, requires no authentication or user interaction, and is listed in the CISA KEV catalog, making it a clear T1190 server-side compromise.

← Back to Overview
HIGH_RISK
Risk Level
9.8
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
HIGH
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2023-11-21

Added to CISA KEV: 2026-08-27 1010 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2023-49105 is a critical WebDAV API authentication bypass vulnerability affecting ownCloud core that allows an unauthenticated attacker to gain unauthorized access to, modify, or delete files. The flaw exists because the system incorrectly accepts pre-signed URLs even when no signing key is configured for a user, provided the attacker knows the target's username. With a CVSS score of 9.8, this vulnerability poses a severe risk to data integrity and confidentiality for exposed ownCloud deployments.

Exploitation

  • Active Exploitation: While frequently discussed alongside other critical ownCloud vulnerabilities like CVE-2023-49103, specific reports of mass exploitation in the wild for CVE-2023-49105 are less publicized than its counterparts; however, the vulnerability is trivial to exploit, and security researchers have identified its potential for remote code execution and privilege escalation [1].
  • Threat Actors: There is no widespread attribution to specific threat actors or ransomware groups publicly documented for this specific CVE.
  • Proof-of-Concept: Exploit concepts and technical assessments are publicly available, detailing how attackers can generate malicious URLs to conduct arbitrary file operations [3].
  • Attack Prerequisites: This is a remote, network-based attack that requires no authentication, no user interaction, and no specialized privileges. The only requirement is knowledge of a valid username on the affected system where the user does not have a signing key configured [2][4].

Affected Products & Patches

  • Affected Versions: ownCloud core versions 10.6.0 through 10.13.0 [3].
  • Patch Availability: The vulnerability was resolved in ownCloud core version 10.13.1 [2].
  • Mitigations: Organizations unable to patch immediately should ensure all users have signing keys configured, though updating to the patched version is the only definitive remediation [2].

Impact

  • Access and Capability: Successful exploitation grants the attacker full control over the file storage of a target user, including the ability to read sensitive documents, modify existing data, or perform unauthorized deletions. Under certain configurations, it can facilitate broader system compromise, including privilege escalation and remote code execution [1].
  • Business Risk: For internet-facing deployments, this vulnerability allows for complete data exfiltration and sabotage without the need for credentials. This poses a catastrophic risk to organizational intellectual property, privacy compliance (e.g., GDPR), and operational continuity.

Sources

  1. Owncloud: details about CVE-2023-49103 and ...

    CVE-2023-49105: Privilege escalation, remote code execution. This bug, which is not related to docker, got a CVSS of 9.8. It affects every ... The vulnerabilities were assigned CVE-2023-49103 and CVE-2023-49105. Note: We performed the security assessment on dockerized Owncloud 10.12.2.CVE-2023-49105…

  2. NVD-CVE-2023-49105 - NIST

    An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if ... CVE-2023-49105 Detail Description An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file wi…

  3. CVE-2023-49105, WebDAV Api Authentication Bypass in ...

    Have you heard of CVE-2023-49105? While the 10/10 CVE-2023-49103 got all the attention last week, organizations should not quickly overlook ... CVE-2023-49105 is an authentication bypass issue affecting ownCloud from version 10.6.0 to version 10.13.0. It allows an attacker to access, modify, or dele…

  4. CVE-2023-49105 - Vulnerability Details - OpenCVE

    An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key…

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed