PT-2023-23726 · Nextcloud+1 · Nextcloud Server+1

Hackitbharat · Publicado 2023-03-27 · Atualizado 2023-12-07 · CVE-2023-32319

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud server versions 24.0.0 through 24.0.10 Nextcloud server versions 25.0.0 through 25.0.4 Nextcloud server versions prior to 26.0.0

Description The issue is related to missing brute-force protection on the WebDAV endpoints via the basic auth header, allowing brute-forcing of user credentials when the provided user name was not an email address.

Recommendations For Nextcloud server versions 24.0.0 through 24.0.10, upgrade to version 24.0.11 or later. For Nextcloud server versions 25.0.0 through 25.0.4, upgrade to version 25.0.5 or later. For Nextcloud server versions prior to 26.0.0, upgrade to version 26.0.0 or later.

Exploit

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

ALT-PU-2023-1517

ALT-PU-2023-1547

ALT-PU-2023-7785

CVE-2023-32319

GHSA-MR7Q-XF62-FW54

Produtos afetados

Alt Linux

Nextcloud Server

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32319.json · Exploit
• https://github.com/nextcloud/server/pull/37227 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mr7q-xf62-fw54 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-32319 · Aviso do Fabricante
• https://t.me/cvenotify/51659 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-32319 · Nota de Segurança
• https://t.me/cvenotify/51239 · Publicação no Telegram