Exception logging in Sharepoint app reveals clear-text connection details
Package
Server
(Nextcloud)
Affected versions
< 23.0.9, < 24.0.5
Patched versions
23.0.9, 24.0.5
Server
(Nextcloud Enterprise)
< 22.2.10.5, < 23.0.9, < 24.0.5
22.2.10.5, 23.0.9, 24.0.5
Impact
When an attacker gets hold of the nextcloud.log, they may gain knowledge of credentials to connect to a SharePoint service.
Patches
It is recommended that the Nextcloud Server is upgraded to 23.0.9 or 24.0.5.
It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.5, 23.0.9 or 24.0.5.
Workarounds
Set the following option in the php.ini
References
For more information
If you have any questions or comments about this advisory: