CVE-2022-39338
Low
Description
user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross site scripting attack vector. The impact is limited due to the restrictive CSP that is applied on this endpoint. Additionally this vulnerability has only been shown to be exploitable in the Safari web browser. This issue has been addressed in version 1.2.1. Users are advised to upgrade. Users unable to upgrade should urge their users to avoid using the Safari web browser.
SeverityLow
CVSS3.5
Exploit probability—
Product
Nextcloud Openid Connect User Backend
PublishedNov 25, 2022
First seenNov 25, 2022
How to fix
Update
- nextcloud openid_connect_user_backend1.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nextcloud openid_connect_user_backend | v < 1.2.1 | 1.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.