CVE-2023-39963

HIGH

Nextcloud Server 20.0.0-27.0.1 - Unauthenticated App Password Creation via Stolen Session

Title source: llm
STIX 2.1

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully stealing a session from a logged in user, to create app passwords for the victim. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://hackerone.com/reports/2067572

Scores

CVSS v3 8.1
EPSS 0.0015
EPSS Percentile 35.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-284
Status published
Products (3)
nextcloud/nextcloud_server 27.0.0 (2 CPE variants)
nextcloud/nextcloud_server 20.0.0 - 20.0.14.15
nextcloud/nextcloud_server 25.0.0 - 25.0.9
Published Aug 10, 2023
Tracked Since Feb 18, 2026