PT-2023-27171 · Nextcloud+1 · Nextcloud+1

Rullzer · Published 2023-08-10 · Updated 2023-08-16 · CVE-2023-39954

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions user oidc versions 1.0.0 through 1.3.2

Description The issue affects the user oidc module, which provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. An attacker with at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers.

Recommendations For versions 1.0.0 through 1.3.2, update to version 1.3.3, which contains a patch for the issue. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2023-39954

GHSA-3F92-5C8P-F6GQ

Affected Products

Nextcloud

User Oidc

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39954.json · Exploit
• https://github.com/nextcloud/user_oidc/pull/636 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39954 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39954 · Vendor Advisory
• https://t.me/cvenotify/56194 · Telegram Post
• https://t.me/cvenotify/56651 · Telegram Post
• https://hackerone.com/reports/1994328 · Note
• https://twitter.com/VulmonFeeds/status/1689678839952093184 · Twitter Post