CVE-2023-23944: Nexcloud Mail app temporarily stores cleartext password in database
Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed. It is recommended that the Nextcloud Mail app is upgraded to 2.2.2. There are no known workarounds for this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Nextcloud mail vulnerability?
The vulnerability ID for this Nextcloud mail vulnerability is CVE-2023-23944.
What is the severity level of CVE-2023-23944?
The severity level of CVE-2023-23944 is medium (6.5).
How does the vulnerability in Nextcloud mail affect user passwords?
In versions prior to 2.2.2, user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure, exposing them to attackers with access to the database.
How can an attacker exploit CVE-2023-23944?
An attacker with access to the database can exploit CVE-2023-23944 by retrieving user passwords stored in cleartext.
What is the recommended solution for CVE-2023-23944?
To mitigate the vulnerability, users should update Nextcloud mail to version 2.2.2 or above.