Lucene search

K
redosRedosROS-20230413-01
HistoryApr 13, 2023 - 12:00 a.m.

ROS-20230413-01

2023-04-1300:00:00
redos.red-soft.ru
3
nextcloud
software
vulnerability
secure browsing
resource consumption
remote access
denial of service
unix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

49.7%

The Nextcloud software vulnerability is related to secure browsing for internal shared
resources, which can be bypassed if re-sharing permissions are also granted.
Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized
access to restricted functions.

The Nextcloud software vulnerability involves uncontrolled resource consumption,
a user could configure a very long password, consuming more resources to validate the password than
than desired. Exploiting the vulnerability could allow an attacker acting remotely to execute a denial of service attack.
a denial-of-service attack.

OSVersionArchitecturePackageVersionFilename
redos7.3x86_64nextcloud<= 25.0.3-1UNKNOWN

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

49.7%