CVE-2019-15623 Information disclosure in Nextcloud Server
Nextcloud Server leaks domain and user IDs to the Lookup Server even when disabled, exposing private user information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-15623?
CVE-2019-15623 is a medium-severity vulnerability in Nextcloud Nextcloud Server, published on 4 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.
Weakness: CWE-359
Which versions are affected by CVE-2019-15623?
It affects 3 products.
Products include Nextcloud Nextcloud Server, Opensuse Backports Sle, Suse Package Hub.
How do I fix CVE-2019-15623?
Apply the vendor's patch.
Is CVE-2019-15623 being exploited?
There is no known exploitation of CVE-2019-15623 in the wild and no public exploit code.
Other vulnerabilities in Nextcloud Nextcloud Server
- CVE-2021-32802 Preview generation used third-party library not suited for user-generated content in Nextcloud server
- CVE-2023-26482 Scope of workflow operations is not validated in nextcloud server
- CVE-2018-3775 Auth bypass in Nextcloud Server
- CVE-2023-35172 Nextcloud Server password reset endpoint is not brute force protected
- CVE-2023-32320 Nextcloud Server's brute force protection allows someone to send more requests than intended
Sources
Also known as GHSA-7vfj-8rgw-2c3q.