CVE-2024-37312
Nextcloud user_oidc app's ID4me feature is available even when disabled
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).
La aplicación user_oidc es un backend de usuario de OpenID Connect para Nextcloud. La falta de control de acceso en el terminal ID4me permite a un atacante registrar una cuenta y eventualmente obtener acceso a los datos que están disponibles para todos los usuarios registrados. Se recomienda actualizar el backend del usuario de OpenID Connect a 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) o 5.0.0 (Nextcloud 25-28).
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-06-05 CVE Reserved
- 2024-06-14 CVE Published
- 2024-06-15 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-284: Improper Access Control
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q | X_refsource_confirm | |
https://github.com/nextcloud/user_oidc/commit/9f68a716ecd264160a7c098b8840313f1ac855f2 | X_refsource_misc | |
https://hackerone.com/reports/2376929 | X_refsource_misc |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Nextcloud Search vendor "Nextcloud" | Security-advisories Search vendor "Nextcloud" for product "Security-advisories" | <= 1.3.6 Search vendor "Nextcloud" for product "Security-advisories" and version " <= 1.3.6" | en |
Affected
|