Lucene search

NextcloudGHSA-4GM7-J7WG-M4FX

HistoryDec 01, 2022 - 9:32 a.m.

No password length limit when creating a user as an administrator

2022-12-0109:32:12

github.com

administrator

dos attack

nextcloud server

nextcloud enterprise server

user accounts

long passwords

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

39.7%

JSON

Description

Impact

An administrator can cause a limited DoS attack against their own server

Patches

It is recommended that the Nextcloud Server is upgraded to 23.0.11, 24.0.7 or 25.0.0
It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11, 23.0.11, 24.0.7 or 25.0.0

Workarounds

Don’t create user accounts with long passwords

References

For more information

If you have any questions or comments about this advisory:

Create a post in nextcloud/security-advisories
Customers: Open a support ticket at support.nextcloud.com

References

github.com/nextcloud/server/pull/34500

hackerone.com/reports/1727424

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

39.7%

JSON

Related for GHSA-4GM7-J7WG-M4FX