Lucene search

K
redosRedosROS-20231024-03
HistoryOct 24, 2023 - 12:00 a.m.

ROS-20231024-03

2023-10-2400:00:00
redos.red-soft.ru
11
oauth2 token
nextcloud storage
vulnerability
memcached
denial of service
remote exploitation
privilege escalation
speed limit reset

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

33.8%

The OAuth2 token vulnerability of the cloud-based software for creating and utilizing Nextcloud storage
Nextcloud data storage software is related to the storage of OAuth2 tokens in plaintext. Exploitation of the vulnerability could
allow an attacker acting remotely to gain access to the server and escalate their privileges

Vulnerability in the Memcached component of the cloud software for creating and using the
Nextcloud datastore is related to the use of Memcached as memcache.distributed, the limitation of the
speed limit on the server could be unexpectedly reset, causing the speed counter to reset earlier than
intended. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of
denial of service

OSVersionArchitecturePackageVersionFilename
redos7.3x86_64nextcloud< 25.0.5-5UNKNOWN

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

33.8%