PT-2023-19947 · Nextcloud+1 · Nextcloud Enterprise Server+2

Primebeast · Publicado 2023-01-16 · Atualizado 2023-02-23 · CVE-2023-25161

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 25.0.1 Nextcloud Server versions prior to 24.0.8 Nextcloud Server versions prior to 23.0.12 Nextcloud Enterprise Server versions prior to 25.0.1 Nextcloud Enterprise Server versions prior to 24.0.8 Nextcloud Enterprise Server versions prior to 23.0.12

Description The issue is related to missing rate limiting on password reset functionality in Nextcloud Server and Nextcloud Enterprise Server. This could result in service slowdown, storage overflow, or cost impact when using external email services.

Recommendations Upgrade to Nextcloud Server 25.0.1 to receive a patch. Upgrade to Nextcloud Server 24.0.8 to receive a patch. Upgrade to Nextcloud Server 23.0.12 to receive a patch. Upgrade to Nextcloud Enterprise Server 25.0.1 to receive a patch. Upgrade to Nextcloud Enterprise Server 24.0.8 to receive a patch. Upgrade to Nextcloud Enterprise Server 23.0.12 to receive a patch.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2023-1055

ALT-PU-2023-1176

CVE-2023-25161

GHSA-492H-596Q-XR2F

Produtos afetados

Alt Linux

Nextcloud Enterprise Server

Nextcloud Server

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25161.json · Exploit
• https://github.com/nextcloud/server/pull/34632 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-596q-xr2f · Aviso do Fabricante
• https://hackerone.com/reports/1691195 · Nota
• https://osv.dev/vulnerability/CVE-2023-25161 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25161 · Nota de Segurança
• https://t.me/cibsecurity/58041 · Publicação no Telegram