// For flags

CVE-2024-22403

OAuth2 authorization codes are valid indefinetly in Nextcloud server

Severity Score

3.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.

El servidor Nextcloud es un sistema de nube personal autohospedado. En las versiones afectadas, los códigos OAuth no caducaban. Cuando un atacante tuviera acceso a un código de autorización, podría autenticarse en cualquier momento utilizando el código. A partir de la versión 28.0.0, los códigos OAuth se invalidan después de 10 minutos y ya no se autenticarán. Para aprovechar esta vulnerabilidad, un atacante necesitaría interceptar un código OAuth de una sesión de usuario. Se recomienda actualizar el servidor Nextcloud a 28.0.0. No se conocen workarounds para esta vulnerabilidad.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2024-01-10 CVE Reserved
  • 2024-01-18 CVE Published
  • 2024-01-27 EPSS Updated
  • 2024-08-01 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-613: Insufficient Session Expiration
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Nextcloud
Search vendor "Nextcloud"
 Nextcloud Server
Search vendor "Nextcloud" for product "Nextcloud Server"
 < 28.0.0
Search vendor "Nextcloud" for product "Nextcloud Server" and version " < 28.0.0"
-
Affected