PT-2023-8433 · Nextcloud+1 · Nextcloud Enterprise Server+2
Alacn1
·
Published
2023-11-21
·
Updated
2025-01-24
·
CVE-2023-48305
CVSS v2.0
4.3
Medium
| Vector | AV:L/AC:L/Au:M/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Nextcloud Server versions 25.0.0 through 25.0.10
Nextcloud Server versions 26.0.0 through 26.0.5
Nextcloud Server versions 27.0.0 through 27.0.0 (prior to 27.1.0)
Nextcloud Enterprise Server versions 25.0.0 through 25.0.10
Nextcloud Enterprise Server versions 26.0.0 through 26.0.5
Nextcloud Enterprise Server versions 27.0.0 through 27.0.0 (prior to 27.1.0)
Description
The issue is related to the storage of critical information in plaintext. When the log level is set to debug in Nextcloud Server, the user ldap app logs user passwords in plaintext into the log file. If the log file is leaked or shared, the users' passwords would be leaked.
Recommendations
For Nextcloud Server and Nextcloud Enterprise Server versions prior to 25.0.11, 26.0.6, and 27.1.0, update to version 25.0.11, 26.0.6, or 27.1.0 to resolve the issue.
As a temporary workaround for all affected versions, change the config setting
loglevel to 1 or higher.
Restrict access to the log file to minimize the risk of exploitation.Exploit
Fix
Cleartext Storage of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Nextcloud Enterprise Server
Nextcloud Server