CVE-2023-49103 Details

A vulnerability exists in the ownCloud GraphAPI application, specifically in versions 0.2.x prior to 0.2.1 and 0.3.x prior to 0.3.1. The issue arises from the app's reliance on a third-party library, GetPhpInfo.php, which, when accessed, discloses PHP environment configuration details through the phpinfo() function. This information includes webserver environment variables that, in containerized deployments, may contain sensitive data such as the ownCloud admin password, mail server credentials, and license key. The vulnerability persists even when the GraphAPI app is disabled, and while Docker containers deployed before February 2023 are not affected, the issue remains a concern for ownCloud installations outside of a containerized environment.

Users are advised to delete the file 'GetPhpInfo.php' from the GraphAPI application's vendor directory and to change any exposed secrets such as the ownCloud admin password, mail server credentials, database credentials, and S3 access keys.