5.4

CVE-2023-28848

CSRF protection on user_oidc login returned the expected token in case of an error

CSRF protection on user_oidc login returned the expected token in case of an error

user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second request. Users should upgrade user_oidc to 1.3.0 to receive a patch for the issue. No known workarounds are available.
Mögliche Gegenmaßnahme
user_oidc: No workaround available
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ User Oidc Version >= 1.0.0 < 1.3.0
Weitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt user_oidc
Version >= 1.0.0, < 1.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.33% 0.248
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
security-advisories@github.com 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-52hv-xw32-wf7f
Vendor Advisory
https://github.com/nextcloud/user_oidc/pull/580
Patch
Vendor Advisory
https://hackerone.com/reports/1878381
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-52hv-xw32-wf7f
Third Party Advisory