CVE-2018-3761

Published: Jul 5, 2018Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.

Affected (2)

Products: Nextcloud: Nextcloud Server

Nextcloud

1 product

Nextcloud Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Nextcloud Server	Before 12.0.8
Nextcloud Nextcloud Server	From 13.0.0 to 13.0.3

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

https://hackerone.com/reports/343111

Source: support@hackerone.com

Third Party Advisory

https://nextcloud.com/security/advisory/?id=nc-sa-2018-003

Source: support@hackerone.com

Broken LinkVendor Advisory

https://hackerone.com/reports/343111

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://nextcloud.com/security/advisory/?id=nc-sa-2018-003

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

Timeline

No history available yet.