CVE-2023-45151

2023-10-1619:15:10

Google

osv.dev

nextcloud

plaintext

oauth2

token

storage

vulnerability

upgrade

version

25.0.8

26.0.3

27.0.1

server

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.0%

JSON

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability.

CPENameOperatorVersion
servereq25.0.7rc1
servereq25.0.2rc1
servereq25.0.8rc2
servereq25.0.2rc2
servereq25.0.4
servereq25.0.3rc2
servereq25.0.1
servereq25.0.5rc1
servereq25.0.6
servereq25.0.5

Name	Operator	Version
server	eq	25.0.7rc1
server	eq	25.0.2rc1
server	eq	25.0.8rc2
server	eq	25.0.2rc2
server	eq	25.0.4
server	eq	25.0.3rc2
server	eq	25.0.1
server	eq	25.0.5rc1
server	eq	25.0.6
server	eq	25.0.5