CVE-2023-45151

🗓️ 16 Oct 2023 19:15:10Reported by [email protected]Type

Nextcloud server vulnerability with plaintext OAuth2 token

Reporter	Title	Published	Views	Family All 53
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud storage solutions lies in the storage of OAuth2 tokens in an exposed manner. This allows attackers to gain access to the server and enhance their privileges.	26 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-45151	16 Oct 202322:32	–	circl
CNNVD	Nextcloud Security Breach	16 Oct 202300:00	–	cnnvd
CVE	CVE-2023-45151	16 Oct 202318:41	–	cve
Cvelist	CVE-2023-45151 OAuth2 client_secret stored in plain text in the Nextcloud database	16 Oct 202318:41	–	cvelist
EUVD	EUVD-2023-49458	3 Oct 202520:07	–	euvd
Nextcloud	OAuth2 client_secret stored in plain text in the database	16 Oct 202307:22	–	nextcloud
Hacker One	Nextcloud: OAuth2 client_secret stored in plain text in the database	19 May 202311:22	–	hackerone
OpenVAS	Nextcloud Server 25.x < 25.0.8, 26.x < 26.0.3, 27.x < 27.0.1 Improper Access Control Vulnerability (GHSA-hhgv-jcg9-p4m9)	17 Oct 202300:00	–	openvas
OSV	CVE-2023-45151 OAuth2 client_secret stored in plain text in the Nextcloud database	16 Oct 202318:41	–	osv

NVD

Node

nextcloud nextcloud_serverRange25.0.0–25.0.8enterprise

nextcloud nextcloud_serverRange26.0.0–26.0.3enterprise

Source	Link
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-hhgv-jcg9-p4m9
github	www.github.com/nextcloud/server/pull/38398
hackerone	www.hackerone.com/reports/1994324

21 Nov 2024 08:26Current

7.5High risk

Vulners AI Score7.5

CVSS 3.16.5 - 8.8

EPSS0.0069