Vulnerability Description
Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user. It is recommended that the Nextcloud Server is upgraded to 25.0.6 or 26.0.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | Nextcloud Server | >= 25.0.2, < 25.0.6 |
Related Weaknesses (CWE)
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-cVendor Advisory
- https://github.com/nextcloud/text/pull/3946Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-cVendor Advisory
- https://github.com/nextcloud/text/pull/3946Patch
FAQ
What is CVE-2023-32318?
CVE-2023-32318 is a vulnerability with a CVSS score of 7.2 (HIGH). Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies ...
How severe is CVE-2023-32318?
CVE-2023-32318 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-32318?
Check the references section above for vendor advisories and patch information. Affected products include: Nextcloud Nextcloud Server.