CVE-2023-39958
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Nextcloud Server, an open source cloud platform, has a vulnerability that allows an attacker to brute force the OAuth2 client secrets. The issue exists in versions from 22.0.0 up to 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1.
Risk Assessment
The lack of proper protection may lead to the compromise of user data and unauthorized access to resources. Attackers could gain access to sensitive information by breaking OAuth2 client secrets.
Recommendation
It is recommended to upgrade to the versions that contain the patches, namely 25.0.9, 26.0.4, 27.0.1, and the corresponding Nextcloud Enterprise Server versions. Additionally, monitor systems for unauthorized access attempts.
Original NVD description (English source)
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.