CVE-2022-39339

Katalog CVE

CVSS 4.3 · Medium EPSS 0,46%

Kerentanan Cleartext Transmission of Sensitive Information pada nextcloud openid connect user backend. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may have been able to compromise account security. This issue has been addressed in in user_oidc v1.2.1. Users are advised to upgrade. Users unable to upgrade may use https to access Nextcloud. Set an HTTPS discovery URL in the provider settings (in Nextcloud OIDC admin settings).

Rincian

Terbit di NVD

25 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-319: Cleartext Transmission of Sensitive Information

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vff-cq8h-chhg patch · advisory pihak ketiga
• https://github.com/nextcloud/user_oidc/pull/495 patch · advisory pihak ketiga
• https://hackerone.com/reports/1687005 permissions required · advisory pihak ketiga