PT-2020-20022 · Nextcloud · Nextcloud Preferred Providers App

Abhishek Raj + 1 · Published 2020-07-30 · Updated 2020-08-03 · CVE-2020-8202

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Preferred Providers app version 1.6.0

Description The issue is related to an improper check of inputs in the Nextcloud Preferred Providers app, which allows a denial of service attack to be performed when a very long password is used.

Recommendations For Nextcloud Preferred Providers app version 1.6.0, update to a newer version that contains a fix for this issue, as using a very long password can cause a denial of service attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2020-8202

Affected Products

Nextcloud Preferred Providers App

References · 4

• 🔥 https://hackerone.com/reports/840598 · Exploit
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-028 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8202 · Security Note