CVE-2022-39339
Medium
Description
user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may have been able to compromise account security. This issue has been addressed in in user_oidc v1.2.1. Users are advised to upgrade. Users unable to upgrade may use https to access Nextcloud. Set an HTTPS discovery URL in the provider settings (in Nextcloud OIDC admin settings).
SeverityMedium
CVSS4.3
Exploit probability—
Product
Nextcloud Openid Connect User Backend
PublishedNov 25, 2022
First seenNov 25, 2022
Weakness typeCWE-319CWE-319
How to fix
Update
- nextcloud openid_connect_user_backend1.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nextcloud openid_connect_user_backend | v < 1.2.1 | 1.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.