CVEvulnerability
CVE-2023-32318
6.7 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-05-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.2 HIGH — CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
- CVSS 3.1 ([email protected])
- 6.7 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-613
Description
Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user. It is recommended that the Nextcloud Server is upgraded to 25.0.6 or 26.0.1.
Affected configurations
• nextcloud nextcloud server (>= 25.0.2 < 25.0.6)
• nextcloud nextcloud server 26.0.0
Related
Weakness · not in database (1)
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38 Vendor Advisory
- https://github.com/nextcloud/text/pull/3946 Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38 Vendor Advisory
- https://github.com/nextcloud/text/pull/3946 Patch