CVE-2023-49103
About
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.
Rainforest analyst review
The vulnerability lives in ownCloud's graphapi app, which bundles a third-party GetPhpInfo.php library reachable over the web. Requesting its URL returns the full phpinfo() output, and that page dumps every environment variable the web server holds. In containerized ownCloud deployments those variables commonly include the admin password, mail server credentials, and license key, so an unauthenticated attacker gets high-value secrets from a single GET request, no login required. Disabling the graphapi app does not close the path, which caught many operators off guard.
ownCloud is a self-hosted file-sync and share platform, so the credentials it leaks unlock the very system holding an organization's documents. Mass exploitation began almost immediately after disclosure, with attackers scanning broadly for exposed instances, which means any internet-facing server should be treated as breached rather than simply patched. Update graphapi to 0.2.1 or 0.3.1, but the essential step is rotation: change the ownCloud admin password, mail credentials, license key, and any object-store or database secrets that were present in the environment, since those may have already been harvested.
References
Related CVEs
Frequently asked questions
What is CVE-2023-49103?
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver.
How severe is CVE-2023-49103?
CVE-2023-49103 carries a CVSS 3.1 base score of 10, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 100 out of 100, in the critical band.
How is CVE-2023-49103 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2023-49103?
Public advisories list the following as affected: graph api. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2023-49103?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.