PT-2023-8433 · Nextcloud+1 · Nextcloud Enterprise Server+2
Alacn1
·
Publicado
2023-11-21
·
Atualizado
2025-01-24
·
CVE-2023-48305
CVSS v2.0
4.3
Média
| Vetor | AV:L/AC:L/Au:M/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Nextcloud Server versions 25.0.0 through 25.0.10
Nextcloud Server versions 26.0.0 through 26.0.5
Nextcloud Server versions 27.0.0 through 27.0.0 (prior to 27.1.0)
Nextcloud Enterprise Server versions 25.0.0 through 25.0.10
Nextcloud Enterprise Server versions 26.0.0 through 26.0.5
Nextcloud Enterprise Server versions 27.0.0 through 27.0.0 (prior to 27.1.0)
Description
The issue is related to the storage of critical information in plaintext. When the log level is set to debug in Nextcloud Server, the user ldap app logs user passwords in plaintext into the log file. If the log file is leaked or shared, the users' passwords would be leaked.
Recommendations
For Nextcloud Server and Nextcloud Enterprise Server versions prior to 25.0.11, 26.0.6, and 27.1.0, update to version 25.0.11, 26.0.6, or 27.1.0 to resolve the issue.
As a temporary workaround for all affected versions, change the config setting
loglevel to 1 or higher.
Restrict access to the log file to minimize the risk of exploitation.Exploit
Correção
Cleartext Storage of Sensitive Information
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Nextcloud Enterprise Server
Nextcloud Server