CVE-2023-45151
OAuth2 client_secret stored in plain text in the Nextcloud database
概要
OAuth2 client_secret stored in plain text in the Nextcloud database
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web hackerone.com