4.3

CVE-2022-39339: nextcloud openid_connect_user_backend

CVSS: 4.3v3.1MediumModified
Published 25-11-2022Last modified 23-04-2025
Open JSON

Vulnerability summary

CVE-2022-39339 is a medium (CVSS 4.3) vulnerability in nextcloud openid_connect_user_backend. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.2% of scored vulnerabilities.

Overall risk
17/100
0100
Low · default modelHow is this calculated?
CVSS score
4.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.46%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 25-11-2022
    PublishedVulnerability first disclosed.
  2. 23-04-2025
    Last modifiedVulnerability information updated.

Description

user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may have been able to compromise account security. This issue has been addressed in in user_oidc v1.2.1. Users are advised to upgrade. Users unable to upgrade may use https to access Nextcloud. Set an HTTPS discovery URL in the provider settings (in Nextcloud OIDC admin settings).

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

+0.02 pp

From 0.44% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Nextcloud2 products

1 vendor · 2 products

References

3 links