Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AC AV A C I PR S UI CVSS EPSS %ile KEV L N H H H N C N 10.0 .7843 99.6 YES
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Nov 21 Reserved by mitre Nov 21 Published (CNA: mitre) Nov 30 Added to CISA KEV, remediation due 2023-12-21
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.
| Date | Event | Detail |
|---|---|---|
| November 21, 2023 | Reserved | Reserved by mitre |
| November 21, 2023 | Published | Published (CNA: mitre) |
| November 30, 2023 | KEV ADDED | Added to CISA KEV, remediation due 2023-12-21 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | n/a | — | n/a | — |
Authoritative record: CVE-2023-49103 at cve.org
Weaknesses: CWE-200
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-49103 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
