CVE-2023-39963

CVSS V2 None CVSS V3 None
Description
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully stealing a session from a logged in user, to create app passwords for the victim. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.
Overview
  • CVE ID
  • CVE-2023-39963
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-08-10T18:15:10
  • Last Modified Date
  • 2023-08-16T13:39:48
Weakness Enumerations
CWE URL
NVD-CWE-noinfo http://cwe.mitre.org/data/definitions/NVD-noinfo.html
CWE-284 http://cwe.mitre.org/data/definitions/284.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* 1 OR 20.0.0 20.0.14.15
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* 1 OR 21.0.0 21.0.9.13
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* 1 OR 22.0.0 22.2.10.14
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* 1 OR 23.0.0 23.0.12.9
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* 1 OR 24.0.0 24.0.12.5
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:* 1 OR 25.0.0 25.0.9
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* 1 OR 25.0.0 25.0.9
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:* 1 OR 26.0.0 26.0.4
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:* 1 OR 26.0.0 26.0.4
cpe:2.3:a:nextcloud:nextcloud_server:27.0.0:*:*:*:-:*:*:* 1 OR
cpe:2.3:a:nextcloud:nextcloud_server:27.0.0:*:*:*:enterprise:*:*:* 1 OR
References
Reference URL Reference Tags
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j4qm-5q5x-54m5 Vendor Advisory
https://github.com/nextcloud/server/pull/39416 Patch
https://hackerone.com/reports/2067572 Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-39963
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39963
History
Created Old Value New Value Data Type Notes
2023-09-06 03:30:53 Added to TrackCVE
2023-09-06 03:30:55 Weakness Enumeration new