VULNERABILITY INTELLIGENCE

CVE-2023-45151

CVSS score6.5 MEDIUM

EPSS probability0.61%

CISA KEVNot currently listed

Published2023-10-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Description

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability.

Weakness classification

security-advisories@github.com: CWE-312
nvd@nist.gov: CWE-312

Primary references

security-advisories@github.com — Vendor Advisory
security-advisories@github.com — Issue Tracking, Patch
security-advisories@github.com — Permissions Required
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required