VULNERABILITY INTELLIGENCE

CVE-2018-3761

CVSS score8.1 HIGH
EPSS probability1.66%
CISA KEVNot currently listed
Published2018-07-05
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Description

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.

Weakness classification

  • CWE-287: Improper Authentication

Primary references