PT-2023-22005

CVE-2023-28848

Published

2023-04-04

Updated

2023-04-10

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions user oidc versions 1.0.0 through 1.3.0

Description A vulnerability in user oidc, the OIDC connect user backend for Nextcloud, an open source collaboration platform, allowed an attacker to bypass the state protection. This was possible because an attacker could copy the expected state token from the first request to their second request.

Recommendations For versions 1.0.0 through 1.3.0, upgrade user oidc to version 1.3.0 to receive a patch for the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers

CVE-2023-28848