CVE-2023-32318: User session not correctly destroyed on logout
Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user. It is recommended that the Nextcloud Server is upgraded to 25.0.6 or 26.0.1.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Nextcloud server vulnerability?
The vulnerability ID for this Nextcloud server vulnerability is CVE-2023-32318.
What is the severity level of CVE-2023-32318?
CVE-2023-32318 has a severity level of medium (6.7).
Which software versions are affected by CVE-2023-32318?
CVE-2023-32318 affects Nextcloud Server versions between 25.0.2 and 25.0.6 (inclusive), as well as version 26.0.0.
How does the vulnerability in session handling affect Nextcloud Server?
The vulnerability in session handling between Nextcloud Server and the Nextcloud Text app prevents a correct destruction of the session on logout if cookies are not cleared manually.
Is there a fix available for CVE-2023-32318?
Yes, a fix for CVE-2023-32318 is available.