CVE-2023-23948 MEDIUM

CVE-2023-23948: ownCloud Android app vulnerable to SQL Injection

Vendor Owncloud
Product Android
Weakness CWE-89 · SQLi
Published February 13, 2023
Last update March 10, 2025
View on NVD All CVEs

CVSS base score

6.2/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in `FileContentProvider.kt`. This issue can lead to information disclosure. Two databases, `filelist` and `owncloud_database`, are affected. In version 3.0, the `filelist` database was deprecated. However, injections affecting `owncloud_database` remain relevant as of version 3.0.

Key dates

02Disclosure timeline

February 13, 2023 CVE published
March 10, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-1821 code-projects Crime Reporting System police_add.php sql injection CVE-2025-11740 wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection CVE-2025-12287 Bdtask Wholesale Inventory Control and Inventory Management System edit_profile sql injection CVE-2026-9411 SourceCodester Indian Invoicing System Invoice Generation IGST_Invoice.php sql injection CVE-2026-9617 PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function