CISA adds ownCloud and Google Chrome bugs to its Known Exploited Vulnerabilities catalog

CVE-2023-49103 is an unauthenticated information disclosure flaw in ownCloud's graphapi app (0.2.x before 0.2.1 and 0.3.x before 0.3.1), which ships a third-party GetPhpInfo.php page that returns the full PHP phpinfo output when its URL is requested. An attacker with no credentials or user interaction simply accesses that URL over the network, and the phpinfo output reveals all of the webserver's environment variables plus other potentially sensitive configuration details. In containerized deployments these environment variables frequently include the ownCloud admin password, mail server credentials, and license key, giving attackers direct credentials for the server; notably, disabling the graphapi app does not remove the exposed file. Affected deployments are ownCloud installations running the vulnerable graphapi versions, especially ownCloud Docker images built after February 2023, while containers built before February 2023 are not vulnerable to the credential disclosure. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-11-30, the EPSS score is 78.4% (top percentile), and public reporting says threat actors have begun exploiting the flaw, though no public PoC is known.

Do: Upgrade the graphapi app to version 0.2.1 or 0.3.1, and note that simply disabling the app is not sufficient — ensure the GetPhpInfo.php file is removed per vendor instructions. Operators of containerized ownCloud deployments (Docker images from February 2023 onward) should assume the ownCloud admin password, mail server credentials, and license key were exposed, rotate them, and review web logs for requests to the GetPhpInfo.php URL. CISA KEV requires applying vendor mitigations or discontinuing use of the product if mitigations are unavailable.

CVE-2023-5217 is a heap buffer overflow (CWE-787) in the VP8 encoding path of libvpx, the open-source video codec library bundled with Google's Chromium/Chrome browser. A remote attacker can trigger the flaw by luring a user to a crafted HTML page whose web content invokes the vulnerable VP8 encoding code, corrupting the heap and potentially achieving code execution in the affected browser. Anyone running Google Chrome/Chromium — or other browsers and software that embed libvpx, as CISA notes the library's use is 'not limited to Google Chrome' — is affected. Exploitation is confirmed: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-10-02 (ransomware association: unknown), though no public proof-of-concept is available and a CVSS score has not been published; EPSS puts the 30-day exploitation probability at 49% (99th percentile). Defenders should treat this as an actively exploited browser vulnerability requiring prompt patching.

Do: Update Chrome/Chromium to the vendor release that fixes CVE-2023-5217 — Google shipped the fix with its late-September 2023 stable-channel security update, so verify the exact build number in Google's advisory (it is not specified in the source data). Also patch any other products bundling libvpx (other browsers, media/ffmpeg-based tooling) per vendor instructions, and ensure KEV compliance by applying the required mitigations or discontinuing use of affected builds by the CISA deadline.

CVE-2023-6345 is an integer overflow (CWE-190) in Skia, the 2D graphics rendering library used by Google Chrome and other Chromium-based browsers. It is triggered when a compromised renderer processes a malicious file, allowing a remote attacker who has already gained code execution in the renderer process to escape the Chrome sandbox and run code with broader privileges. Users of Google Chrome prior to 119.0.6045.199 are affected, as are Chromium-based derivatives including Microsoft Edge (Chromium) and Chromium packages shipped by Debian and Fedora. The flaw was rated High by Chromium, carries a CVSS 3.1 score of 9.6, and was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-30. Google has patched the bug in Chrome 119.0.6045.199, and news reporting confirms it was being actively exploited in the wild at the time of the fix.

Do: Update Google Chrome to 119.0.6045.199 or later and restart the browser to fully apply the fix; on Debian and Fedora, apply the updated chromium packages from the distro repositories, and allow Microsoft's Chromium fix to flow into Edge before trusting affected builds. Verify browser versions (chrome://version or equivalent) across managed fleets, and note that because this is CISA KEV-listed (added 2023-11-30), US federal agencies must patch per vendor instructions or discontinue use by the required deadline.