PT-2023-2378 · Nextcloud+2 · Nextcloud+2

Aditya404 · Publicado 2023-01-23 · Atualizado 2023-04-13 · CVE-2023-25816

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Nextcloud versions 25.0.0 through 25.0.2

Description The issue is related to Uncontrolled Resource Consumption in Nextcloud, an Open Source private cloud software. A user can configure a very long password, which consumes more resources on password validation than desired, potentially leading to a denial of service. This can be exploited by a remote attacker.

Recommendations For versions 25.0.0 through 25.0.2, update to version 25.0.3 to resolve the issue. As a temporary workaround is not available, ensuring timely updates is crucial.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

ALT-PU-2023-1116

ALT-PU-2023-1176

BDU:2023-02153

CVE-2023-25816

GHSA-53Q2-CM29-7J83

Produtos afetados

Alt Linux

Nextcloud

Red Os

Referências · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25821.json · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41970.json · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25816.json · Exploit
• 🔥 https://hackerone.com/reports/1820864 · Exploit
• https://github.com/nextcloud/server/issues/34015 · Nota
• https://github.com/nextcloud/server/pull/35965 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-53q2-cm29-7j83 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02260 · Nota de Segurança
• https://t.me/cvenotify/45749 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25816 · Aviso do Fabricante
• https://packages.altlinux.org/ru/vuln/CVE-2023-25816 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25161 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25816 · Nota de Segurança
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-nextcloud-cve-2023-25821-cve-2023-25816 · Nota
• https://bdu.fstec.ru/vul/2023-02153 · Nota de Segurança