PT-2022-24908 · Nextcloud+1 · User Oidc+1

Lauritz · Published 2022-11-25 · Updated 2022-12-01 · CVE-2022-39338

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions user oidc versions prior to 1.2.1

Description The issue is related to the improper validation of discovery URLs in the user oidc OpenID Connect user backend for Nextcloud, potentially leading to a stored cross-site scripting attack vector. The impact is limited due to the restrictive Content Security Policy (CSP) applied on this endpoint. This vulnerability has only been shown to be exploitable in the Safari web browser.

Recommendations For versions prior to 1.2.1, upgrade to version 1.2.1 to address the issue. If an upgrade is not possible, advise users to avoid using the Safari web browser as a temporary mitigation measure.

Exploit

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2022-39338

GHSA-5FPW-795H-RG57

Affected Products

Safari

User Oidc

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39338.json · Exploit
• https://github.com/nextcloud/user_oidc/pull/496 · Patch
• https://osv.dev/vulnerability/CVE-2022-39338 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39338 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5fpw-795h-rg57 · Note
• https://t.me/cvenotify/38499 · Telegram Post
• https://hackerone.com/reports/1687410 · Note