CVE-2023-39954 - Vulnerability Details - OpenCVE

user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, an attacker that obtained at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers. user_oidc 1.3.3 contains a patch. No known workarounds are available.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Nextcloud	User Oidc

Configuration 1 [-]

cpe:2.3:a:nextcloud:user_oidc:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq
https://github.com/nextcloud/user_oidc/pull/636
https://hackerone.com/reports/1994328

History

Thu, 03 Oct 2024 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-08-10T14:32:27.032Z

Updated: 2024-10-03T15:08:09.372Z

Reserved: 2023-08-07T16:27:27.075Z

Link: CVE-2023-39954

Vulnrichment

Updated: 2024-08-02T18:18:10.158Z

NVD

Status : Modified

Published: 2023-08-10T15:15:09.693

Modified: 2024-11-21T08:16:06.523

Link: CVE-2023-39954

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-39954", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-08-07T16:27:27.075Z", "datePublished": "2023-08-10T14:32:27.032Z", "dateUpdated": "2024-10-03T15:08:09.372Z"}, "containers": {"cna": {"title": "user_oidc app stores client secret unencrypted in database", "problemTypes": [{"descriptions": [{"cweId": "CWE-311", "lang": "en", "description": "CWE-311: Missing Encryption of Sensitive Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq"}, {"name": "https://github.com/nextcloud/user_oidc/pull/636", "tags": ["x_refsource_MISC"], "url": "https://github.com/nextcloud/user_oidc/pull/636"}, {"name": "https://hackerone.com/reports/1994328", "tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/1994328"}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"version": ">= 1.0.0, < 1.3.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-08-10T14:32:27.032Z"}, "descriptions": [{"lang": "en", "value": "user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, an attacker that obtained at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers. user_oidc 1.3.3 contains a patch. No known workarounds are available."}], "source": {"advisory": "GHSA-3f92-5c8p-f6gq", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:18:10.158Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq"}, {"name": "https://github.com/nextcloud/user_oidc/pull/636", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/nextcloud/user_oidc/pull/636"}, {"name": "https://hackerone.com/reports/1994328", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://hackerone.com/reports/1994328"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-03T15:00:38.350562Z", "id": "CVE-2023-39954", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-03T15:08:09.372Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq", "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/nextcloud/user_oidc/pull/636", "name": "https://github.com/nextcloud/user_oidc/pull/636", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://hackerone.com/reports/1994328", "name": "https://hackerone.com/reports/1994328", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:18:10.158Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-39954", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-03T15:00:38.350562Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-03T15:00:45.833Z"}}], "cna": {"title": "user_oidc app stores client secret unencrypted in database", "source": {"advisory": "GHSA-3f92-5c8p-f6gq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": ">= 1.0.0, < 1.3.3"}]}], "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq", "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nextcloud/user_oidc/pull/636", "name": "https://github.com/nextcloud/user_oidc/pull/636", "tags": ["x_refsource_MISC"]}, {"url": "https://hackerone.com/reports/1994328", "name": "https://hackerone.com/reports/1994328", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, an attacker that obtained at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers. user_oidc 1.3.3 contains a patch. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-311", "description": "CWE-311: Missing Encryption of Sensitive Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-08-10T14:32:27.032Z"}}}, "cveMetadata": {"cveId": "CVE-2023-39954", "state": "PUBLISHED", "dateUpdated": "2024-10-03T15:08:09.372Z", "dateReserved": "2023-08-07T16:27:27.075Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-08-10T14:32:27.032Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:user_oidc:*:*:*:*:*:*:*:*", "matchCriteriaId": "97E08567-1AEA-413F-A59D-C80E63DD58BB", "versionEndExcluding": "1.3.3", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, an attacker that obtained at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers. user_oidc 1.3.3 contains a patch. No known workarounds are available."}, {"lang": "es", "value": "user_oidc proporciona el backend de usuario de conexi\u00f3n OIDC para Nextcloud, una plataforma en la nube de c\u00f3digo abierto. A partir de la versi\u00f3n 1.0.0 y antes de la versi\u00f3n 1.3.3, un atacante que haya obtenido al menos acceso de lectura a una instant\u00e1nea de la base de datos puede suplantar la identidad del servidor Nextcloud ante servidores vinculados. user_oidc 1.3.3 contiene un parche. No se conocen soluciones disponibles."}], "id": "CVE-2023-39954", "lastModified": "2024-11-21T08:16:06.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-10T15:15:09.693", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nextcloud/user_oidc/pull/636"}, {"source": "security-advisories@github.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/1994328"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/nextcloud/user_oidc/pull/636"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/1994328"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-311"}], "source": "security-advisories@github.com", "type": "Secondary"}]}