{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T14:42:29.334","vulnerabilities":[{"cve":{"id":"CVE-2023-45151","sourceIdentifier":"security-advisories@github.com","published":"2023-10-16T19:15:10.957","lastModified":"2026-06-17T06:28:19.630","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability."},{"lang":"es","value":"El servidor Nextcloud es una plataforma de nube doméstica de código abierto. Las versiones afectadas de Nextcloud almacenaron tokens OAuth2 en texto plano, lo que permite a un atacante que haya obtenido acceso al servidor elevar potencialmente sus privilegios. Este problema se solucionó y se recomienda a los usuarios actualizar su servidor Nextcloud a la versión 25.0.8, 26.0.3 o 27.0.1. No se conocen workarounds para esta vulnerabilidad."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nextcloud","product":"security-advisories","versions":[{"version":">= 25.0.0, < 25.0.8","status":"affected"},{"version":">= 26.0.0, < 26.0.3","status":"affected"},{"version":">= 27.0.0, < 27.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-09-16T14:57:28.810714Z","id":"CVE-2023-45151","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-312"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-312"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*","versionStartIncluding":"25.0.0","versionEndExcluding":"25.0.8","matchCriteriaId":"A2EE7242-A7BB-4FE3-8617-9C355C68EB2A"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"25.0.0","versionEndExcluding":"25.0.8","matchCriteriaId":"05C7C20F-A320-425C-BECF-E895E5ACF1CF"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*","versionStartIncluding":"26.0.0","versionEndExcluding":"26.0.3","matchCriteriaId":"636E2B84-2F89-4F35-9ADF-BCB1761B2E2D"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"26.0.0","versionEndExcluding":"26.0.3","matchCriteriaId":"54FD90F4-2243-4A99-954B-FCC44EE180AB"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:27.0.0:*:*:*:-:*:*:*","matchCriteriaId":"13650329-BCD1-4FDB-9446-5133C0EDC905"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:27.0.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DB1974B0-31C5-4E22-9E8C-BD40C6B54D0C"}]}]}],"references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hhgv-jcg9-p4m9","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/nextcloud/server/pull/38398","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://hackerone.com/reports/1994324","source":"security-advisories@github.com","tags":["Permissions Required"]},{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hhgv-jcg9-p4m9","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://github.com/nextcloud/server/pull/38398","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"]},{"url":"https://hackerone.com/reports/1994324","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required"]}]}}]}