CVE-2023-25818

🗓️ 27 Mar 2023 20:15:09Reported by [email protected]Type

Nextcloud server vulnerability patched in versions 24.0.10 and 25.0.

Reporter	Title	Published	Views	Family All 19
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud Server’s data storage solution lies in the lack of authentication attempt limits, allowing attackers to bypass passwords.	25 Jan 202400:00	–	bdu_fstec
CNNVD	Nextcloud 安全漏洞	27 Mar 202300:00	–	cnnvd
CVE	CVE-2023-25818	27 Mar 202320:00	–	cve
Cvelist	CVE-2023-25818 Missing brute force protection on password reset token in Nextcloud Server	27 Mar 202320:00	–	cvelist
EUVD	EUVD-2023-29710	3 Oct 202520:07	–	euvd
Nextcloud	Missing brute force protection on password reset token	27 Mar 202310:32	–	nextcloud
OpenVAS	Nextcloud Server 24.x < 24.0.10, 25.x < 25.0.4 Missing Brute Force Protection Vulnerability (GHSA-v243-x6jc-42mp)	28 Mar 202300:00	–	openvas
OSV	CVE-2023-25818 Missing brute force protection on password reset token in Nextcloud Server	27 Mar 202320:00	–	osv
Prion	Design/Logic Flaw	27 Mar 202320:15	–	prion
Positive Technologies	PT-2023-20326 · Nextcloud +1 · Nextcloud Enterprise Server +2	22 Mar 202300:00	–	ptsecurity

NVD

Node

nextcloud nextcloud_serverRange21.0.0–21.0.9.10enterprise

nextcloud nextcloud_serverRange22.0.0–22.2.10.10enterprise

nextcloud nextcloud_serverRange23.0.0–23.0.12.5enterprise

nextcloud nextcloud_serverRange24.0.0–24.0.10enterprise

nextcloud nextcloud_serverRange25.0.0–25.0.4enterprise

Source	Link
github	www.github.com/nextcloud/server/pull/36489
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-v243-x6jc-42mp
github	www.github.com/nextcloud/server/pull/36489/commits/704eb3aa6cecc0a646f5cca4290b595f493f9ed3

21 Nov 2024 07:50Current

6Medium risk

Vulners AI Score6

CVSS 3.15.3 - 7.1

EPSS0.00147