CVE-2024-37312: Nextcloud user_oidc app's ID4me feature is available even when disabled
useroidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37312?
CVE-2024-37312 is classified as a high severity vulnerability due to the lack of access control on the ID4me endpoint.
How do I fix CVE-2024-37312?
To fix CVE-2024-37312, ensure that you update your Nextcloud user_oidc app to a version that includes the necessary access control measures.
What versions of the user_oidc app are affected by CVE-2024-37312?
CVE-2024-37312 affects the Nextcloud user_oidc app versions between 3.0.0 and 4.0.0, 4.0.0 and 5.0.0, and 5.0.0 to 28.
What are the potential risks associated with CVE-2024-37312?
The potential risks of CVE-2024-37312 include unauthorized account registration and access to sensitive data available to all registered users.
Is there a public report available for CVE-2024-37312?
Yes, there is a public report for CVE-2024-37312 available on platforms like GitHub and HackerOne.