« Volver al listado

CVE-2025-53828

Estado: AplazadaAlta (8.5)—

SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In SharePoint for ownCloud prior to version 0.4.1, which corresponds to ownCloud 10 prior to 10.15.3, an attacker with administrative privileges can use a SSRF vulnerability in the SharePoint app to execute arbitrary code on the system. Upgrade ownCloud 10 to version 10.15.3 or later to receive SharePoint for ownCloud 0.4.1, the fixed version.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N, PR:L (privilegios de admin requeridos), CWE-918 (SSRF). El atacante aprovecha SSRF para acceder a servicios remotos internos y ejecutar código arbitrario en el sistema.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramSSL/TLS InspectionRestrict Web-Based Content

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Owncloud — OwncloudAIOwncloud — Sharepoint FOR OwncloudAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-53828",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53828",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-07T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "owncloud",
          "product": "SharePoint",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.4.1"
            }
          ]
        },
        {
          "vendor": "owncloud",
          "product": "ownCloud 10",
          "versions": [
            {
              "status": "affected",
              "version": "< 10.15.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-06T16:16:26.903",
  "references": [
    {
      "url": "https://github.com/owncloud/security-advisories/security/advisories/GHSA-4m66-rpfj-m5f6",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In SharePoint for ownCloud prior to version 0.4.1, which corresponds to ownCloud 10 prior to 10.15.3, an attacker with administrative privileges can use a SSRF vulnerability in the SharePoint app to execute arbitrary code on the system. Upgrade ownCloud 10 to version 10.15.3 or later to receive SharePoint for ownCloud 0.4.1, the fixed version."
    },
    {
      "lang": "es",
      "value": "SharePoint para ownCloud es una aplicación para usar SharePoint con la aplicación de almacenamiento, sincronización y compartición de archivos ownCloud Classic. En SharePoint para ownCloud anterior a la versión 0.4.1, que corresponde a ownCloud 10 anterior a la 10.15.3, un atacante con privilegios administrativos puede usar una vulnerabilidad SSRF en la aplicación de SharePoint para ejecutar código arbitrario en el sistema. Actualice ownCloud 10 a la versión 10.15.3 o posterior para recibir SharePoint para ownCloud 0.4.1, la versión corregida."
    }
  ],
  "lastModified": "2026-09-30T15:10:00.560",
  "sourceIdentifier": "security-advisories@github.com"
}