Riskcovery

CVE-2023-45151

OAuth2 client_secret stored in plain text in the Nextcloud database

State
Published
Severity
6.5 Medium
Published
Oct 16, 2023
Updated
Sep 16, 2024
Reserved
Oct 4, 2023

Read the record on cve.org

Description

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NGitHub_M

Weaknesses

  • CWE-312 Cleartext Storage of Sensitive Information

Affected Products

ProductVersions
security-advisoriesnextcloud
  • >= 25.0.0, < 25.0.8Affected
  • >= 26.0.0, < 26.0.3Affected
  • >= 27.0.0, < 27.0.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.