Lucene search

[email protected]CVE-2023-25161

HistoryFeb 13, 2023 - 9:15 p.m.

CVE-2023-25161

2023-02-1321:15:14

CWE-284

[email protected]

web.nvd.nist.gov

nextcloud

server

software

vulnerability

cve-2023-25161

security

update

rate limiting

password reset

nextcloud enterprise server

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.4%

JSON

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known workarounds are available.

Affected configurations

Vulners

NVD

Node

nextcloudnextcloudMatch25.0.0

nextcloudnextcloudRange24.0.0–24.0.8

nextcloudnextcloudRange<23.0.2

VendorProductVersionCPE
nextcloudnextcloud25.0.0cpe:2.3:a:nextcloud:nextcloud:25.0.0:*:*:*:*:*:*:*
nextcloudnextcloud*cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*
nextcloudnextcloud*cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nextcloud	nextcloud	25.0.0	cpe:2.3:a:nextcloud:nextcloud:25.0.0:::::::*
nextcloud	nextcloud	*	cpe:2.3:a:nextcloud:nextcloud::::::::
nextcloud	nextcloud	*	cpe:2.3:a:nextcloud:nextcloud::::::::

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": "= 25.0.0",
        "status": "affected"
      },
      {
        "version": ">= 24.0.0, < 24.0.8",
        "status": "affected"
      },
      {
        "version": "< 23.0.2",
        "status": "affected"
      }
    ]
  }
]