PT-2023-27171 · Nextcloud+1 · Nextcloud+1

Rullzer · Publicado 2023-08-10 · Atualizado 2023-08-16 · CVE-2023-39954

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions user oidc versions 1.0.0 through 1.3.2

Description The issue affects the user oidc module, which provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. An attacker with at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers.

Recommendations For versions 1.0.0 through 1.3.2, update to version 1.3.3, which contains a patch for the issue. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation.

Exploit

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2023-39954

GHSA-3F92-5C8P-F6GQ

Produtos afetados

Nextcloud

User Oidc

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39954.json · Exploit
• https://github.com/nextcloud/user_oidc/pull/636 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq · Aviso do Fabricante
• https://t.me/cvenotify/56194 · Publicação no Telegram
• https://t.me/cvenotify/56651 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-39954 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-39954 · Aviso do Fabricante
• https://hackerone.com/reports/1994328 · Nota
• https://twitter.com/VulmonFeeds/status/1689678839952093184 · Publicação no Twitter