PT-2023-8428 · Nextcloud+1 · Nextcloud Text+2

Nickvergessen · Publicado 2023-05-26 · Atualizado 2025-01-24 · CVE-2023-32318

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 25.0.6 Nextcloud Server versions prior to 26.0.1

Description A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account, the previous session would be continued and the attacker would be authenticated as the previously logged in user. This issue is related to incorrect session expiration.

Recommendations For Nextcloud Server versions prior to 25.0.6, upgrade to 25.0.6 to resolve the issue. For Nextcloud Server versions prior to 26.0.1, upgrade to 26.0.1 to resolve the issue. As a temporary workaround, consider clearing cookies manually after logout to prevent session continuation.

Exploit

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

ALT-PU-2023-2009

ALT-PU-2023-7785

ALT-PU-2025-1855

BDU:2024-00712

CVE-2023-32318

GHSA-Q8C4-CHPJ-6V38

Produtos afetados

Alt Linux

Nextcloud Server

Nextcloud Text

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32318.json · Exploit
• https://github.com/nextcloud/text/pull/3946 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32318 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-00712 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-32318 · Aviso do Fabricante
• https://t.me/cibsecurity/64729 · Publicação no Telegram