← Back

CVE-2023-45151

nvd nist
Published: Oct 16, 2023Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability.

Affected (6)

Nextcloud
1 product
Nextcloud Server
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Nextcloud
Nextcloud Server
From 25.0.0 to 25.0.8
Nextcloud Server
From 26.0.0 to 26.0.3
Nextcloud Server
From 25.0.0 to 25.0.8
Nextcloud Server
From 26.0.0 to 26.0.3
Nextcloud Server
Version 27.0.0
Nextcloud Server
Version 27.0.0

Related CWEs

CWE-312
Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (6)

Source: security-advisories@github.com
Vendor Advisory
Source: security-advisories@github.com
Issue TrackingPatch
Source: security-advisories@github.com
Permissions Required
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatch
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions Required

Timeline

No history available yet.