CVE-2023-48305: Nextcloud Server user_ldap app logs user passwords in the log file on level debug
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, when the log level was set to debug, the userldap app logged user passwords in plaintext into the log file. If the log file was then leaked or shared in any way the users' passwords would be leaked. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. As a workaround, change config setting loglevel to 1 or higher (should always be higher than 1 in production environments).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-48305.
What is the severity of CVE-2023-48305?
The severity of CVE-2023-48305 is medium with a score of 4.2.
What is the affected software?
Nextcloud Server versions prior to 25.0.11, 26.0.6, and 27.1.0, including the enterprise edition, are affected.
How does CVE-2023-48305 impact Nextcloud Server?
When the log level is set to debug, the user_ldap app in Nextcloud Server logs user passwords in plain text.
Is there a fix available for CVE-2023-48305?
Yes, the fix is available in Nextcloud Server versions 25.0.11, 26.0.6, and 27.1.0.