CVE-2023-48305: Nextcloud Server user_ldap app logs user passwords in the log file on level debug
First published: Tue Nov 21 2023(Updated: )
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, when the log level was set to debug, the user_ldap app logged user passwords in plaintext into the log file. If the log file was then leaked or shared in any way the users' passwords would be leaked. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. As a workaround, change config setting `loglevel` to `1` or higher (should always be higher than 1 in production environments).
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Nextcloud Server | >=25.0.0<25.0.11 | |
| Nextcloud Nextcloud Server | >=25.0.0<25.0.11 | |
| Nextcloud Nextcloud Server | >=26.0.0<26.0.6 | |
| Nextcloud Nextcloud Server | >=26.0.0<26.0.6 | |
| Nextcloud Nextcloud Server | >=27.0.0<27.1.0 | |
| Nextcloud Nextcloud Server | >=27.0.0<27.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-48305.
What is the severity of CVE-2023-48305?
The severity of CVE-2023-48305 is medium with a score of 4.2.
What is the affected software?
Nextcloud Server versions prior to 25.0.11, 26.0.6, and 27.1.0, including the enterprise edition, are affected.
How does CVE-2023-48305 impact Nextcloud Server?
When the log level is set to debug, the user_ldap app in Nextcloud Server logs user passwords in plain text.
Is there a fix available for CVE-2023-48305?
Yes, the fix is available in Nextcloud Server versions 25.0.11, 26.0.6, and 27.1.0.
- collector/nvd-api
- agent/references
- agent/type
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/title
- agent/softwarecombine
- agent/tags
- agent/weakness
- agent/remedy
- agent/severity
- agent/first-publish-date
- agent/description
- vendor/nextcloud
- canonical/nextcloud nextcloud server
- version/nextcloud nextcloud server/25.0.0
- version/nextcloud nextcloud server/26.0.0
- version/nextcloud nextcloud server/27.0.0