PT-2023-19314 · Nextcloud · Nextcloud Mail

Christophwurst · Published 2023-02-06 · Updated 2023-02-14 · CVE-2023-23944

Positive Technologies (AI Summary)

CVSS v3.1

2.0

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 2.2.2

Description The issue concerns the storage of user passwords in cleartext in the database during the OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed.

Recommendations For versions prior to 2.2.2, upgrade the Nextcloud Mail app to 2.2.2 to resolve the issue. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-23944

GHSA-G86R-X755-93F4

Affected Products

Nextcloud Mail

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23944.json · Exploit
• https://github.com/nextcloud/mail/pull/7797 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g86r-x755-93f4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23944 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23944 · Vendor Advisory
• https://t.me/cibsecurity/57607 · Telegram Post
• https://hackerone.com/reports/1806275 · Note