Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2023-39958
HistoryAug 10, 2023 - 6:15 p.m.

CVE-2023-39958

2023-08-1018:15:09
CWE-307
[email protected]
web.nvd.nist.gov
nextcloud
oauth2
client secrets
brute force

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

20.6%

JSON

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.

Affected configurations

NVD
Node
nextcloudnextcloud_serverRange22.0.0–22.2.10.14enterprise
OR
nextcloudnextcloud_serverRange23.0.0–23.0.12.9enterprise
OR
nextcloudnextcloud_serverRange24.0.0–24.0.12.5enterprise
OR
nextcloudnextcloud_serverRange25.0.0–25.0.9-
OR
nextcloudnextcloud_serverRange25.0.0–25.0.9enterprise
OR
nextcloudnextcloud_serverRange26.0.0–26.0.4-
OR
nextcloudnextcloud_serverRange26.0.0–26.0.4enterprise
OR
nextcloudnextcloud_serverMatch27.0.0-
OR
nextcloudnextcloud_serverMatch27.0.0enterprise

Related

cvelist 1
osv 1
hackerone 1
nextcloud 1
prion 1
cve 1
redos 1
openvas 1
cvelist
cvelist
CVE-2023-39958 Missing brute force protection on password reset token OAuth2 API controller
2023-08-10 17:04:51
osv
osv
CVE-2023-39958
2023-08-10 18:15:09
hackerone
hackerone
Nextcloud: Missing brute force protection on OAuth2 API controller
2021-07-12 17:52:21
nextcloud
nextcloud
Missing brute force protection on OAuth2 API controller
2023-08-10 07:16:54
prion
prion
Code injection
2023-08-10 18:15:00
cve
cve
CVE-2023-39958
2023-08-10 18:15:09
redos
redos
ROS-20230913-02
2023-09-13 00:00:00
openvas
openvas
Nextcloud Server Multiple Vulnerabilities (GHSA-vv27-g2hq-v48h, GHSA-g97r-8ffm-hfpj, GHSA-qhgm-w4gx-gvgp, GHSA-xwxx-2752-w3xm, GHSA-j4qm-5q5x-54m5)
2023-08-10 00:00:00

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

20.6%

JSON
Related for NVD:CVE-2023-39958
cvelist1osv1hackerone1nextcloud1prion1cve1redos1openvas1