CVE-2023-45151

    Dashboard / Vulnerabilities / CVE-2023-45151

    CVE-2023-45151

    Published: 16 Oct 2023Last Modified: 28 Oct 2026

    Summary: OAuth2 client_secret stored in plain text in the Nextcloud database

    Details: Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability.

    References: https://hackerone.com/reports/1994324, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45151.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hhgv-jcg9-p4m9, https://nvd.nist.gov/vuln/detail/CVE-2023-45151, https://github.com/nextcloud/server/pull/38398

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 20ea9a25353129b56d46951fe7d23939665ab2b2
    Fixed -82f744bb016b059a55d1c6c476a665029e55cedc

    Affected versions

    27.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-45151 | CVE-DB