CVE-2023-22470 Nextcloud Deck vulnerable to uncontrolled resource consumption

2023-01-1400:32:28

CWE-400

GitHub_M

www.cve.org

nextcloud

deck

vulnerability

resource consumption

dos

upgrade

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

32.1%

JSON

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A database error can be generated potentially causing a DoS when performed multiple times. There are currently no known workarounds. It is recommended that the Nextcloud Server is upgraded to 1.6.5 or 1.7.3 or 1.8.2.

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": ">= 1.6.0, < 1.6.5",
        "status": "affected"
      },
      {
        "version": ">= 1.7.0, < 1.7.3",
        "status": "affected"
      },
      {
        "version": ">= 1.8.0, < 1.8.2",
        "status": "affected"
      }
    ]
  }
]