CVE-2023-49103, CVE-2023-49104, CVE-2023-49105

On 21 November 2023 ownCloud published advisories for three vulnerabilities—most critically CVE-2023-49103 (CVSS 10) in the graphapi extension that can disclose PHP environment variables (potentially exposing admin and service credentials in containerized deployments) and which has a public PoC and reports of mass exploitation; CVE-2023-49105 (CVSS 9.8) permitting authentication bypass and file modification/deletion; and CVE-2023-49104 (CVSS 8.7) enabling subdomain redirect bypass. Arctic Wolf recommends immediate patching to the fixed versions, deleting a vulnerable test file for CVE-2023-49103, rotating exposed secrets, and disabling the "Allow Subdomains" option as a workaround for CVE-2023-49104.