Nextcloud user_oidc 1.0.01.3.2 Impersonation via DB Snapshot (CVE202339954)
CVE-2023-39954 Published on August 10, 2023
user_oidc app stores client secret unencrypted in database
user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, an attacker that obtained at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers. user_oidc 1.3.3 contains a patch. No known workarounds are available.
Vulnerability Analysis
CVE-2023-39954 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Missing Encryption of Sensitive Data
The software does not encrypt sensitive or critical information before storage or transmission. The lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.
Products Associated with CVE-2023-39954
Want to know whenever a new CVE is published for Nextcloud User Oidc? stack.watch will email you.
Affected Versions
nextcloud security-advisories Version >= 1.0.0, < 1.3.3 is affected by CVE-2023-39954Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.