// For flags

CVE-2023-48305

Nextcloud Server user_ldap app logs user passwords in the log file on level debug

Severity Score

4.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, when the log level was set to debug, the user_ldap app logged user passwords in plaintext into the log file. If the log file was then leaked or shared in any way the users' passwords would be leaked. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. As a workaround, change config setting `loglevel` to `1` or higher (should always be higher than 1 in production environments).

Nextcloud Server proporciona almacenamiento de datos para Nextcloud, una plataforma en la nube de código abierto. A partir de la versión 25.0.0 y antes de las versiones 25.0.11, 26.0.6 y 27.1.0 de Nextcloud Server y Nextcloud Enterprise Server, cuando el nivel de registro se configuró para depurar, la aplicación user_ldap registró las contraseñas de los usuarios en texto plano en el archivo de registro. Si el archivo de registro se filtrara o se compartiera de alguna manera, se filtrarían las contraseñas de los usuarios. Las versiones 25.0.11, 26.0.6 y 27.1.0 de Nextcloud Server y Nextcloud Enterprise Server contienen un parche para este problema. Como workaround, cambie la configuración "loglevel" a "1" o superior (siempre debe ser superior a 1 en entornos de producción).

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-11-14 CVE Reserved
  • 2023-11-21 CVE Published
  • 2023-11-22 EPSS Updated
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-312: Cleartext Storage of Sensitive Information
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Nextcloud
Search vendor "Nextcloud"
 Nextcloud Server
Search vendor "Nextcloud" for product "Nextcloud Server"
 >= 25.0.0 < 25.0.11
Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 25.0.0 < 25.0.11"
-
Affected
Nextcloud
Search vendor "Nextcloud"
 Nextcloud Server
Search vendor "Nextcloud" for product "Nextcloud Server"
 >= 25.0.0 < 25.0.11
Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 25.0.0 < 25.0.11"
enterprise
Affected
Nextcloud
Search vendor "Nextcloud"
 Nextcloud Server
Search vendor "Nextcloud" for product "Nextcloud Server"
 >= 26.0.0 < 26.0.6
Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 26.0.0 < 26.0.6"
-
Affected
Nextcloud
Search vendor "Nextcloud"
 Nextcloud Server
Search vendor "Nextcloud" for product "Nextcloud Server"
 >= 26.0.0 < 26.0.6
Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 26.0.0 < 26.0.6"
enterprise
Affected
Nextcloud
Search vendor "Nextcloud"
 Nextcloud Server
Search vendor "Nextcloud" for product "Nextcloud Server"
 >= 27.0.0 < 27.1.0
Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 27.0.0 < 27.1.0"
-
Affected
Nextcloud
Search vendor "Nextcloud"
 Nextcloud Server
Search vendor "Nextcloud" for product "Nextcloud Server"
 >= 27.0.0 < 27.1.0
Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 27.0.0 < 27.1.0"
enterprise
Affected