Vulnerability · Published Jan 18, 2024 · Assigned by GitHub_M
CVE-2024-22400Open redirect in user_saml via RelayState parameter in Nextcloud User Saml
Low 3.1
In plain English
A low-severity open redirect in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.5%top 60.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up on a uncontrolled thirdparty server. It is recommended that the User Saml app is upgraded to version 5.1.5, 5.2.5, or 6.0.1. There are no known workarounds for this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | >= 5.0.0, < 5.1.5>= 5.2.0, < 5.2.5>= 6.0.0, < 6.0.1 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-622q-xhfr-xmv7 x_refsource_CONFIRM
- https://github.com/nextcloud/user_saml/pull/788 x_refsource_MISC
- https://github.com/nextcloud/user_saml/commit/b184304a476deeba36e92b70562d5de7c2f85f8a x_refsource_MISC
- https://hackerone.com/reports/2263044 x_refsource_MISC