CVE-2023-39954
Nextcloud User Oidc 1.0.0 – 1.3.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-39954 is a low-severity Missing Encryption of Sensitive Data (CWE-311) vulnerability in Nextcloud User Oidc. Its CVSS base score is 3.8 (Low).
Operationally, ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-43652
Vulnerability Data
user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, an attacker that obtained at least read access to a snapshot of the database can impersonate the Nextcloud…
more
server towards linked servers. user_oidc 1.3.3 contains a patch. No known workarounds are available.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Privacy and security training stresses encryption of sensitive data, reducing missing encryption weaknesses.
Exchange agreements must document security requirements, which would include encryption to protect sensitive data in transit.
The map highlights data actions that involve sensitive data, enabling identification of missing encryption requirements.
Settings can require encryption of sensitive data, preventing missing encryption weaknesses.
Architectures must describe confidentiality protections, which includes mandating encryption for sensitive data in transit and at rest.
Privacy and security curricula stress encryption requirements, reducing missing encryption of sensitive data.
Requires encryption and similar controls for CUI processed or stored externally, preventing missing encryption of sensitive data.
Monitoring detects missing encryption of sensitive data in storage or transit configurations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicit rules requiring encryption for sensitive information in transit eliminate the weakness of sending data without cryptographic protection.
created from the owner's anchor; an owner grade is a row and does not wait for an instrument (Mythos 2026-09-29T15:58Z).
Explicitly calling for protection of data in transit and at rest, plus secure encryption of communications, drives the implementation of encryption that prevents clear-text exposure of sensitive information.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-311, a class-level weakness. Rules are authored against its narrower children: CWE-312.