CVE-2018-3761 - Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint

Back Back to CVE browser

HIGH

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint

Published Jul 5, 2018

8.1

HIGH

CVSS 3.1

EPSS 1.66%

Description

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.

Affected products

Vendor Nextcloud Product Nextcloud Server Default
n/a
- Version
  <13.0.3, <12.0.8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nextcloud

Nextcloud Server

n/a

Version	Status	Constraints
<13.0.3, <12.0.8	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

https://hackerone.com/reports/343111
x_refsource_MISCThird Party Advisory
https://nextcloud.com/security/advisory/?id=nc-sa-2018-003
x_refsource_CONFIRMBroken LinkVendor Advisory

Link	Providers	Tags
https://hackerone.com/reports/343111		x_refsource_MISCThird Party Advisory
https://nextcloud.com/security/advisory/?id=nc-sa-2018-003		x_refsource_CONFIRMBroken LinkVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner hackerone

Published Jul 5, 2018

Updated Aug 5, 2024

Reserved Dec 28, 2017

Link CVE-2018-3761

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-3761

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-3761