PT-2023-19314 · Nextcloud · Nextcloud Mail

Christophwurst · Publicado 2023-02-06 · Atualizado 2023-02-14 · CVE-2023-23944

Positive Technologies (AI Summary)

CVSS v3.1

2.0

Baixa

Vetor base

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 2.2.2

Description The issue concerns the storage of user passwords in cleartext in the database during the OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed.

Recommendations For versions prior to 2.2.2, upgrade the Nextcloud Mail app to 2.2.2 to resolve the issue. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation.

Exploit

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2023-23944

GHSA-G86R-X755-93F4

Produtos afetados

Nextcloud Mail

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23944.json · Exploit
• https://github.com/nextcloud/mail/pull/7797 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g86r-x755-93f4 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23944 · Nota de Segurança
• https://t.me/cibsecurity/57607 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-23944 · Aviso do Fabricante
• https://hackerone.com/reports/1806275 · Nota