PT-2023-27170 · Nextcloud · Nextcloud+1

Rullzer · Publicado 2023-08-10 · Atualizado 2023-08-16 · CVE-2023-39953

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions user oidc versions 1.0.0 through 1.3.2

Description The issue is related to the missing verification of the issuer in the user oidc module for Nextcloud, allowing an attacker to perform a man-in-the-middle attack by returning corrupted or known tokens they have access to.

Recommendations For versions prior to 1.3.3, update to version 1.3.3, which contains a patch for the issue. As a temporary workaround, consider restricting access to the OIDC connect user backend until the patch is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-303

Identificadores relacionados

CVE-2023-39953

GHSA-XX3H-V363-Q36J

Produtos afetados

Nextcloud

User Oidc

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39953.json · Exploit
• https://github.com/nextcloud/user_oidc/pull/642 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xx3h-v363-q36j · Aviso do Fabricante
• https://hackerone.com/reports/2021684 · Nota
• https://osv.dev/vulnerability/CVE-2023-39953 · Aviso do Fabricante
• https://t.me/cvenotify/56650 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1689680611902988315 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-39953 · Nota de Segurança