CVE-2018-3761

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.

Score

CVSS 3.1 8.1 High

Status

Modified - support@hackerone.com

Published

2018-07-05

Last modified

2024-08-05

Weaknesses

CWE-287

Affected products

• Nextcloud Server (Nextcloud)

References

• https://hackerone.com/reports/343111
• https://nextcloud.com/security/advisory/?id=nc-sa-2018-003