CVE-2023-49103
CRITICALCVE-2023-49103 is a critical-severity (CVSS 10) Information Exposure vulnerability. It is in CISA's Known Exploited Vulnerabilities catalog (added 2023-11-30) — treat it as actively exploited and patch now. No vendor fix is recorded yet; mitigation options are listed below.
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL.…
Exploitation Status
Actively exploited in the wild
- Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2023-11-30. Federal agencies were required to remediate by 2023-12-21.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2023-49103.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2023-49103 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).
Where this sits among everything scored
Of 395,249 CVEs with a current EPSS score, this one falls in the 50–90% band (highlighted). Counts from FIRST.org, log-scaled.
Description
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.
Affected Products
graph apiowncloudResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
No fixed release is recorded for CVE-2023-49103 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
How to detect CVE-2023-49103
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id cve-2023-49103 -u https://target- Template
- OwnCloud - Phpinfo Configuration
- Severity
- high
- Impact
- Unauthenticated attackers can access phpinfo configuration details exposing sensitive credentials including admin passwords, mail server credentials, and license keys in containerized deployments.
- Remediation
- Upgrade ownCloud graphapi to version 0.2.1 or 0.3.1 or later, and remove or secure the GetPhpInfo.php file.
Template by ProjectDiscovery nuclei-templates (ritikchaddha), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is CVE-2023-49103 in your dependencies?
Find it across , including transitive dependencies.