PT-2023-19947 · Nextcloud +1 · Nextcloud Enterprise Server +2

🗓️ 03 Feb 2023 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 5 Views

Missing rate limiting on password reset can cause slowdown and storage issues; patch available.

Reporter	Title	Published	Views	Family All 121
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud storage solutions is related to lack of access control measures, allowing attackers to gain unauthorized access to limited functions.	20 Apr 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud storage solutions allows a attacker to cause service failures.	20 Apr 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud storage solutions allows a hacker to gain unauthorized access to protected information.	27 Apr 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud data storage allows a attacker to cause a service failure.	27 Apr 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud data storage allows a hacker to induce a service failure.	27 Apr 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud data storage allows a hacker to induce a service failure.	27 Apr 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud data storage allows a hacker to execute arbitrary code.	27 Apr 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud Server’s data storage system is related to improper access control. This allows a malicious individual to gain unauthorized access to protected information.	25 Jan 202400:00	–	bdu_fstec
Circl	CVE-2023-25159	13 Feb 202320:30	–	circl
Circl	CVE-2023-25161	14 Feb 202300:30	–	circl

Source	Link
github	www.github.com/nextcloud/server/pull/34632
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-596q-xr2f
bdu	www.bdu.fstec.ru/vul/2023-02260
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-25161
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
bdu	www.bdu.fstec.ru/vul/2023-02153
osv	www.osv.dev/vulnerability/CVE-2023-25161
bdu	www.bdu.fstec.ru/vul/2024-00709

23 Feb 2023 00:00Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.15.3 - 8.8

EPSS0.01373

SSVC

vulnerability password reset rate limiting service slowdown storage issues external email services cost impact upgrade patch nextcloud server nextcloud enterprise server