by Kastro
Paper/Archive/CVE-2023-35172

CVE-2023-35172

nextcloud security-advisories — Nextcloud Server password reset endpoint is not brute force protected

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 60.2.602 × 2012.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can bruteforce the password reset links. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. No known workarounds are available.

Affected

ProductAffectedFixed inSource
security-advisoriesNextcloud Server >= 25.0.0, < 25.0.7–CNA
security-advisoriesNextcloud Server >= 26.0.0, < 26.0.2–CNA
security-advisoriesNextcloud Enterprise Server >= 25.0.0, < 25.0.7–CNA
security-advisoriesNextcloud Enterprise Server >= 26.0.0, < 26.0.2–CNA
security-advisoriesNextcloud Enterprise Server >= 21.0.0, < 21.0.9.12–CNA
security-advisoriesNextcloud Enterprise Server >= 22.0.0, < 22.2.10.12–CNA
security-advisoriesNextcloud Enterprise Server >= 23.0.0, < 23.0.12.7–CNA
security-advisoriesNextcloud Enterprise Server >= 24.0.0, < 24.0.12.2–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)8.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/nextcloud/security-advisories/security/advisories/GHSA-mjf5-p765-qmr6refgithub.com/nextcloud/server/pull/38267refhackerone.com/reports/1987062