6.3

CVE-2024-37312

Exploit

Nextcloud user_oidc app's ID4me feature is available even when disabled

ID4me feature of OpenID connect app available even when disabled

user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).
Mögliche Gegenmaßnahme
User OIDC: * Disable app user_oidc
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ User Oidc Version < 5.0.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt User OIDC
Version >= 0.0.0, < 3.0.0
Version >= 4.0.0, < 4.0.0
Version >= 5.0.0, < 5.0.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.64% 0.457
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.3 2.8 3.4
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
security-advisories@github.com 6.3 2.8 3.4
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q
Vendor Advisory
https://github.com/nextcloud/user_oidc/commit/9f68a716ecd264160a7c098b8840313f1ac855f2
Patch
https://hackerone.com/reports/2376929
Third Party Advisory
Exploit
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q
Third Party Advisory