PT-2023-27170 · Nextcloud · Nextcloud+1

Rullzer · Published 2023-08-10 · Updated 2023-08-16 · CVE-2023-39953

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions user oidc versions 1.0.0 through 1.3.2

Description The issue is related to the missing verification of the issuer in the user oidc module for Nextcloud, allowing an attacker to perform a man-in-the-middle attack by returning corrupted or known tokens they have access to.

Recommendations For versions prior to 1.3.3, update to version 1.3.3, which contains a patch for the issue. As a temporary workaround, consider restricting access to the OIDC connect user backend until the patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-303

Related Identifiers

CVE-2023-39953

GHSA-XX3H-V363-Q36J

Affected Products

Nextcloud

User Oidc

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39953.json · Exploit
• https://github.com/nextcloud/user_oidc/pull/642 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xx3h-v363-q36j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39953 · Security Note
• https://hackerone.com/reports/2021684 · Note
• https://t.me/cvenotify/56650 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1689680611902988315 · Twitter Post