Bug 1211788 (CVE-2023-32318) - VUL-0: CVE-2023-32318: nextcloud: session mishandling
Summary: VUL-0: CVE-2023-32318: nextcloud: session mishandling
Status: NEW
Alias: CVE-2023-32318
Product: openSUSE Distribution
Classification: openSUSE
Component: Other (show other bugs)
Version: Leap 15.4
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: ---
Assignee: Eric Schirra
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-05-29 06:37 UTC by Gianluca Gabrielli
Modified: 2024-04-16 08:13 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gianluca Gabrielli 2023-05-29 06:37:31 UTC 
A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user.

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38
Comment 1 Eric Schirra 2023-05-29 07:10:05 UTC 
Tumbleweed, Factory and devel have 25.0.7.
Leap still has the master branch 23 and version 23.0.12. No idea if this is also affected.
Major updates are not allowed and an update from 23 to 25 does not work. No idea what I should do.
Comment 2 Eric Schirra 2024-04-16 08:13:42 UTC 
Whats going on?
Can i close?