Brute force protection allows to send more requests than intended

🗓️ 22 Jun 2023 06:14:26Reported by NextcloudType

Brute force protection allows excessive parallel requests, bypassing configured limits. Upgrade to recommended versions. No workarounds available.

Reporter	Title	Published	Views	Family All 52
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud Server’s data storage solution lies in the lack of authentication attempt limits. This allows attackers to execute a brute-force attack.	25 Jan 202400:00	–	bdu_fstec
CNNVD	Nextcloud 安全漏洞	22 Jun 202300:00	–	cnnvd
CVE	CVE-2023-32320	22 Jun 202320:57	–	cve
Cvelist	CVE-2023-32320 Nextcloud Server's brute force protection allows someone to send more requests than intended	22 Jun 202320:57	–	cvelist
EUVD	EUVD-2023-36567	3 Oct 202520:07	–	euvd
Hacker One	Nextcloud: Brute force protection allows to send more requests than intended	26 Mar 202319:35	–	hackerone
NVD	CVE-2023-32320	22 Jun 202321:15	–	nvd
OpenVAS	Nextcloud Server 25.x < 25.0.7, 26.x < 26.0.2 Multiple Vulnerabilities (GHSA-qphh-6xh7-vffg, GHSA-mjf5-p765-qmr6, GHSA-h7f7-535f-7q87, GHSA-637g-xp2c-qh5h)	23 Jun 202300:00	–	openvas
OpenVAS	Nextcloud Server 25.x < 25.0.7, 26.x < 26.0.2 Brute Force Protection Vulnerability (GHSA-qphh-6xh7-vffg)	23 Jun 202300:00	–	openvas
OSV	CVE-2023-32320 Nextcloud Server's brute force protection allows someone to send more requests than intended	22 Jun 202320:57	–	osv