The vulnerability of cloud-based software for creating and using Nextcloud storage solutions stems from improper handling of insufficient privileges. This allows attackers to gain access to the credentials of other users.

🗓️ 18 Jul 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Cloud Nextcloud storage vulnerability stems from insufficient privileges and external storage at user level, enabling attackers to access other users' credentials.

Reporter	Title	Published	Views	Family All 63
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud storage solutions lies in the improper limitation on excessive authentication attempts, which allows a hacker to compromise the target system.	10 Jul 202300:00	–	bdu_fstec
CNNVD	Nextcloud 安全漏洞	23 Jun 202300:00	–	cnnvd
CNNVD	Nextcloud 安全漏洞	23 Jun 202300:00	–	cnnvd
CVE	CVE-2023-35172	23 Jun 202320:49	–	cve
CVE	CVE-2023-35928	23 Jun 202320:58	–	cve
Cvelist	CVE-2023-35172 Nextcloud Server password reset endpoint is not brute force protected	23 Jun 202320:49	–	cvelist
Cvelist	CVE-2023-35928 Nextcloud user scoped external storage can be used to gather credentials of other users	23 Jun 202320:58	–	cvelist
EUVD	EUVD-2023-39176	3 Oct 202520:07	–	euvd
EUVD	EUVD-2023-39917	3 Oct 202520:07	–	euvd
Nextcloud	User scoped external storage can be used to gather credentials of other users	22 Jun 202313:24	–	nextcloud

Vulners

Node

nextcloud_gmbh nextcloud_enterprise_serverRange21.0.0–21.0.9.12

nextcloud_gmbh nextcloud_enterprise_serverRange22.0.0–22.2.10.12

nextcloud_gmbh nextcloud_enterprise_serverRange23.0.0–23.0.12.7

nextcloud_gmbh nextcloud_enterprise_serverRange24.0.0–24.0.12.2

nextcloud_gmbh nextcloud_enterprise_serverRange25.0.0–25.0.7

nextcloud_gmbh nextcloud_enterprise_serverRange26.0.0–26.0.2

nextcloud_gmbh nextcloud_serverRange25.0.0–25.0.7

nextcloud_gmbh nextcloud_serverRange26.0.0–26.0.2

nextcloud_gmbh nextcloud_enterprise_serverRange19.0.0–19.0.13.9

nextcloud_gmbh nextcloud_enterprise_serverRange20.0.0–20.0.14.14

Source	Link
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-637g-xp2c-qh5h
github	www.github.com/nextcloud/server/pull/38265
hackerone	www.hackerone.com/reports/1978882
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-nextcloud-server-cve-2023-35172-cve-2023-35928/
web	www.web.nvd.nist.gov/view/vuln/detail

18 Jul 2023 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 28.3

CVSS 38.4

EPSS0.00981