Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A self-hosted file sharing platform with a federated sharing feature, such as Nextcloud or ownCloud, is affected. An unauthenticated attacker can add entries to the database that are never automatically removed, which can cause repeated service outages that recur every 24 hours.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Nextcloud server
From 22.0.0 · through 34.0.0