PT-2023-23585 · Nextcloud · User Oidc

Nickvergessen · Publicado 2023-05-25 · Atualizado 2023-06-01 · CVE-2023-32074

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions user oidc app versions prior to 1.3.2

Description The user oidc app, an OpenID Connect user backend for Nextcloud, has an issue where authentication can be broken or bypassed.

Recommendations For versions prior to 1.3.2, upgrade the Nextcloud user oidc app to version 1.3.2.

Exploit

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2023-32074

GHSA-X8MC-84WJ-RF34

Produtos afetados

User Oidc

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32074.json · Exploit
• https://github.com/nextcloud/user_oidc/pull/615 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x8mc-84wj-rf34 · Aviso do Fabricante
• https://t.me/cvenotify/51179 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-32074 · Nota de Segurança
• https://hackerone.com/reports/1954711 · Nota
• https://osv.dev/vulnerability/CVE-2023-32074 · Aviso do Fabricante