CVE-2023-25161

2023-02-1321:15:14

CWE-284

[email protected]

web.nvd.nist.gov

nextcloud

server

password reset functionality

rate limiting

upgrade

patch

cve-2023-25161

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

42.6%

JSON

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known workarounds are available.

Affected configurations

Nvd

Node

nextcloudnextcloud_serverRange<23.0.12

nextcloudnextcloud_serverRange24.0.0–24.0.8

nextcloudnextcloud_serverMatch25.0.0

VendorProductVersionCPE
nextcloudnextcloud_server*cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
nextcloudnextcloud_server25.0.0cpe:2.3:a:nextcloud:nextcloud_server:25.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nextcloud	nextcloud_server	*	cpe:2.3:a:nextcloud:nextcloud_server::::::::
nextcloud	nextcloud_server	25.0.0	cpe:2.3:a:nextcloud:nextcloud_server:25.0.0:::::::*