CVE-2022-39339CWE-319

Cleartext Transmission of Sensitive Information in user_oidc

Medium · published November 25, 2022

CVSS v3.1
4.3
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may have been able to compromise account security. This issue has been addressed in in user_oidc v1.2.1. Users are advised to upgrade. Users unable to upgrade may use https to access Nextcloud. Set an HTTPS discovery URL in the provider settings (in Nextcloud OIDC admin settings).

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00456 · 38.6th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2022-11-25T00:00Z
EPSS history
Timeline
  • 25 NOV 00:00Z
    Cleartext Transmission of Sensitive Information in user_oidc
    cvelistv5