UpHeron
All vulnerabilities

Servers and applications

CVE-2024-22403

Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth…

Severity
Low 3.7
Published
18 Jan 2024
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
28.0.0
Sources
NVD

Affected software

SoftwareAffected versions
NextcloudServers and applications · cpe:a:nextcloud:nextcloud_server
  • Every version before 28.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-22403
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-22403