CVE-2023-23944

MEDIUM Year: 2023
CVSS v3 Score
6.5
Medium
Weakness Type
CWE-312
View all →

Vulnerability Description

Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed. It is recommended that the Nextcloud Mail app is upgraded to 2.2.2. There are no known workarounds for this issue.

Related Vulnerabilities

CVE-2016-3192

MEDIUM
CVSS:6.5(Medium)

Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.

CWE-3122016

CVE-2017-14990

MEDIUM
CVSS:6.5(Medium)

WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack un...

CWE-3122017

CVE-2018-11242

MEDIUM
CVSS:6.5(Medium)

An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartext that might lead to sensitive information disclosure, as dem...

CWE-3122018

CVE-2018-2028

MEDIUM
CVSS:6.5(Medium)

IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attacker to obtain highly sensitive information. IBM X-Force ID:...

CWE-3122018

CVE-2019-13021

MEDIUM
CVSS:6.5(Medium)

The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypted within the MySQL database. This backup copy of the passwo...

CWE-3122019

CVE-2019-13099

MEDIUM
CVSS:6.5(Medium)

The Momo application 2.1.9 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-root user to find out the username/password of a valid user and...

CWE-3122019