Nextcloud Openid Connect User Backend vulnerabilities

2 CVEs affecting Nextcloud Openid Connect User Backend, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-39339, published 2022-11-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-39338, published 2022-11-25. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross site scripting attack vector. The impact…
CVE-2022-39339, published 2022-11-25. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS.…