Medium severity · published Nov 25, 2022
CVE-2022-39339
user_oidc is an OpenID Connect user backend for Nextcloud
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may have been able to compromise account security. This issue has been addressed in in user_oidc v1.2.1. Users are advised to upgrade. Users unable to upgrade may use https to access Nextcloud. Set an HTTPS discovery URL in the provider settings (in Nextcloud OIDC admin settings).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Openid Connect User Backend · Nextcloud
before 1.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39339
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39339
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vff-cq8h-chhg
Patch
https://github.com/nextcloud/user_oidc/pull/495
Permissions Required
https://hackerone.com/reports/1687005
More from Openid Connect User Backend
5.4
CVE-2022-39338
user_oidc is an OpenID Connect user backend for Nextcloud