CVE - CVE-2023-45151

CVE-ID
CVE-2023-45151	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hhgv-jcg9-p4m9 URL:https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hhgv-jcg9-p4m9 MISC:https://github.com/nextcloud/server/pull/38398 URL:https://github.com/nextcloud/server/pull/38398 MISC:https://hackerone.com/reports/1994324 URL:https://hackerone.com/reports/1994324
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20231004	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20231004)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)