CVE-2024-22403: OAuth2 authorization codes are valid indefinetly in Nextcloud server
First published: Thu Jan 18 2024(Updated: )
Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Server | <28.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-22403?
CVE-2024-22403 has been classified as a high severity vulnerability due to the risk of unauthorized access through non-expiring OAuth codes.
How do I fix CVE-2024-22403?
To fix CVE-2024-22403, upgrade to Nextcloud Server version 28.0.0 or higher, where OAuth codes are invalidated after 10 minutes.
What vulnerability does CVE-2024-22403 address?
CVE-2024-22403 addresses a vulnerability in Nextcloud Server where OAuth authorization codes did not expire, allowing attackers to misuse them.
Who is impacted by CVE-2024-22403?
CVE-2024-22403 impacts users of Nextcloud Server versions prior to 28.0.0 that rely on OAuth for authentication.
What are the consequences of CVE-2024-22403?
The consequences of CVE-2024-22403 include potential unauthorized access to user accounts if an attacker obtains a valid OAuth code.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- agent/severity
- agent/remedy
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/nextcloud
- canonical/nextcloud server