CVE-2023-45148 Rate limiter not working reliable when Memcached is installed in Nextcloud

2023-10-1618:51:56

CWE-307

GitHub_M

github.com

cve-2023-45148; nextcloud; rate limiter; memcached; upgrade; version 25.0.11; version 26.0.6; version 27.1.0; config setting; oc memcache redis; install redis

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

4.6

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Nextcloud is an open source home cloud server. When Memcached is used as memcache.distributed the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgrade should change their config setting memcache.distributed to \OC\Memcache\Redis and install Redis instead of Memcached.