Lucene search

GitHub_MCVE-2023-45151

HistoryOct 16, 2023 - 7:15 p.m.

CVE-2023-45151

2023-10-1619:15:10

CWE-312

GitHub_M

web.nvd.nist.gov

nextcloud

server

oauth2

plaintext

vulnerability

upgrade

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

33.8%

JSON

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability.

Affected configurations

Nvd

Vulners

Node

nextcloudnextcloud_serverRange25.0.0–25.0.8-

nextcloudnextcloud_serverRange25.0.0–25.0.8enterprise

nextcloudnextcloud_serverRange26.0.0–26.0.3-

nextcloudnextcloud_serverRange26.0.0–26.0.3enterprise

nextcloudnextcloud_serverMatch27.0.0-

nextcloudnextcloud_serverMatch27.0.0enterprise

VendorProductVersionCPE
nextcloudnextcloud_server*cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*
nextcloudnextcloud_server*cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
nextcloudnextcloud_server27.0.0cpe:2.3:a:nextcloud:nextcloud_server:27.0.0:*:*:*:-:*:*:*
nextcloudnextcloud_server27.0.0cpe:2.3:a:nextcloud:nextcloud_server:27.0.0:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
nextcloud	nextcloud_server	*	cpe:2.3:a:nextcloud:nextcloud_server:::::-:::*
nextcloud	nextcloud_server	*	cpe:2.3:a:nextcloud:nextcloud_server:::::enterprise:::*
nextcloud	nextcloud_server	27.0.0	cpe:2.3:a:nextcloud:nextcloud_server:27.0.0::::-:::
nextcloud	nextcloud_server	27.0.0	cpe:2.3:a:nextcloud:nextcloud_server:27.0.0::::enterprise:::

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": ">= 25.0.0, < 25.0.8",
        "status": "affected"
      },
      {
        "version": ">= 26.0.0, < 26.0.3",
        "status": "affected"
      },
      {
        "version": ">= 27.0.0, < 27.0.1",
        "status": "affected"
      }
    ]
  }
]