CVE-2023-45148 Rate limiter not working reliable when Memcached is installed in Nextcloud

🗓️ 16 Oct 2023 18:51:56Reported by GoogleType

osv

osv🔗 osv.dev👁 13 Views

Nextcloud home cloud server rate limiting issue with Memcache

Reporter	Title	Published	Views	Family All 54
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud storage solutions lies in the storage of OAuth2 tokens in an exposed manner. This allows attackers to gain access to the server and enhance their privileges.	26 Oct 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Memcached component of cloud software for creating and using Nextcloud data storage allows a attacker to cause a service failure.	26 Oct 202300:00	–	bdu_fstec
Circl	CVE-2023-45148	16 Oct 202322:32	–	circl
CNNVD	Nextcloud Security Breach	16 Oct 202300:00	–	cnnvd
CVE	CVE-2023-45148	16 Oct 202318:51	–	cve
Cvelist	CVE-2023-45148 Rate limiter not working reliable when Memcached is installed in Nextcloud	16 Oct 202318:51	–	cvelist
EUVD	EUVD-2023-49455	3 Oct 202520:07	–	euvd
Nextcloud	Rate limiter not working reliable when Memcached is installed	16 Oct 202307:19	–	nextcloud
Hacker One	Nextcloud: Memcached used as RateLimiter backend is no-op	15 Aug 202316:38	–	hackerone
NVD	CVE-2023-45148	16 Oct 202319:15	–	nvd

Source	Link
hackerone	www.hackerone.com/reports/2110945
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45148.json
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-xmhp-7vr4-hp63
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-45148
github	www.github.com/nextcloud/server/pull/40293

02 Apr 2026 09:28Current

4.5Medium risk

Vulners AI Score4.5

CVSS 3.14.3

EPSS0.00177

nextcloud home cloud server rate limiting memcached upgrade redis software