CVE-2022-39339

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-39339

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39339.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-39339

Aliases

GHSA-2vff-cq8h-chhg

Published

2022-11-25T00:00:00Z

Modified

2025-12-04T10:36:00.828828Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Cleartext Transmission of Sensitive Information in user_oidc

Details

useroidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may have been able to compromise account security. This issue has been addressed in in useroidc v1.2.1. Users are advised to upgrade. Users unable to upgrade may use https to access Nextcloud. Set an HTTPS discovery URL in the provider settings (in Nextcloud OIDC admin settings).

Database specific

{
    "cwe_ids": [
        "CWE-319"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39339.json"
}

References

Affected packages

Git / github.com/nextcloud/user_oidc

Affected ranges

Type: GIT
Repo: https://github.com/nextcloud/user_oidc
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

2175e5d10f6083051f6ce14c034c437e7892699a

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.2.1

v0.3.0

v0.3.1

v0.3.2

v1.*

v1.0.0

v1.1.0

v1.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39339.json"