OpenID Connect User Backend Vulnerability in Nextcloud
CVE-2024-52512

6.1MEDIUM

Key Information:

Vendor

Nextcloud
Status
user_oidc
Vendor
CVE Published:
15 November 2024

What is CVE-2024-52512?

The user_oidc application, an OpenID Connect backend for Nextcloud, is susceptible to a vulnerability that allows a malicious user to create a malformed login link. This manipulated link, when accessed, can redirect the authenticated user to an arbitrary URL. To mitigate this issue, it is crucial to upgrade the user_oidc app to version 6.1.0 or later, thus preventing potential exploitation and ensuring a secure authentication process.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/nextcloud/security-advisories/security...
https://github.com/nextcloud/user_oidc/pull/961
https://github.com/nextcloud/user_oidc/commit/c923428d519...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.