ByteOS Network

NVD Vulnerability Details :

CVE-2024-37312

Analyzed

Source-security-advisories@github.com

Published At-14 Jun, 2024 | 15:15

Updated At-14 Aug, 2025 | 19:18

user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.3	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary	3.1	6.3	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CPE Matches

Nextcloud GmbH

>>user_oidc>>Versions before 5.0.0(exclusive)

cpe:2.3:a:nextcloud:user_oidc:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-284	Secondary	security-advisories@github.com
NVD-CWE-noinfo	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q	security-advisories@github.com	Vendor Advisory
https://github.com/nextcloud/user_oidc/commit/9f68a716ecd264160a7c098b8840313f1ac855f2	security-advisories@github.com	Patch
https://hackerone.com/reports/2376929	security-advisories@github.com	Exploit Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://github.com/nextcloud/user_oidc/commit/9f68a716ecd264160a7c098b8840313f1ac855f2	af854a3a-2127-422b-91ae-364da2661108	Patch
https://hackerone.com/reports/2376929	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History