CVE-2023-48305

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-48305
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-48305.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-48305
Aliases
  • GHSA-35p6-4992-w5fr
Published
2023-11-21T22:17:36.124Z
Modified
2026-07-15T01:49:21.598528540Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Nextcloud Server user_ldap app logs user passwords in the log file on level debug
Details

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, when the log level was set to debug, the user_ldap app logged user passwords in plaintext into the log file. If the log file was then leaked or shared in any way the users' passwords would be leaked. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. As a workaround, change config setting loglevel to 1 or higher (should always be higher than 1 in production environments).

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48305.json",
    "cwe_ids": [
        "CWE-312"
    ]
}
References

Affected packages

Git / github.com/nextcloud/server

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
20ea9a25353129b56d46951fe7d23939665ab2b2
Fixed
97d754dcf1aa3f166ead03a9f6a9165270c73647
Introduced
62cfd3b4c9ff4d8cdbbe6dcc8b63a1085bb94e3d
Fixed
1f6197544b21d1dc9d4cae54a5311b5992e666c6
Introduced
add4e4365a4040d2e4e6aa79c0d03c3edd78583c
Fixed
4ff639eb51629cded66eeef2f4cf56a4c4a81984
Database specific 
{
    "cpe": [
        "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "25.0.0"
        },
        {
            "fixed": "25.0.11"
        },
        {
            "introduced": "26.0.0"
        },
        {
            "fixed": "26.0.6"
        },
        {
            "introduced": "27.0.0"
        },
        {
            "fixed": "27.1.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v25.*
v25.0.0
v25.0.1
v25.0.10
v25.0.10rc1
v25.0.11rc1
v25.0.1rc1
v25.0.2
v25.0.2rc1
v25.0.2rc2
v25.0.2rc3
v25.0.3
v25.0.3rc1
v25.0.3rc2
v25.0.4
v25.0.4rc1
v25.0.5
v25.0.5rc1
v25.0.6
v25.0.6rc1
v25.0.7
v25.0.7rc1
v25.0.8
v25.0.8rc1
v25.0.8rc2
v25.0.9
v25.0.9rc1
v25.0.9rc2
v26.*
v26.0.0
v26.0.1
v26.0.1rc1
v26.0.2
v26.0.2rc1
v26.0.3
v26.0.3rc1
v26.0.3rc2
v26.0.4
v26.0.4rc1
v26.0.4rc2
v26.0.5
v26.0.5rc1
v26.0.6rc1
v27.*
v27.0.0
v27.0.1
v27.0.1rc1
v27.0.1rc2
v27.0.2
v27.0.2rc1
v27.1.0beta2
v27.1.0beta3
v27.1.0rc1
v27.1.0rc2
v27.1.0rc3
v27.1.0rc4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-48305.json"