PT-2023-19947 · Nextcloud+1 · Nextcloud Enterprise Server+2

Primebeast · Published 2023-01-16 · Updated 2023-02-23 · CVE-2023-25161

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 25.0.1 Nextcloud Server versions prior to 24.0.8 Nextcloud Server versions prior to 23.0.12 Nextcloud Enterprise Server versions prior to 25.0.1 Nextcloud Enterprise Server versions prior to 24.0.8 Nextcloud Enterprise Server versions prior to 23.0.12

Description The issue is related to missing rate limiting on password reset functionality in Nextcloud Server and Nextcloud Enterprise Server. This could result in service slowdown, storage overflow, or cost impact when using external email services.

Recommendations Upgrade to Nextcloud Server 25.0.1 to receive a patch. Upgrade to Nextcloud Server 24.0.8 to receive a patch. Upgrade to Nextcloud Server 23.0.12 to receive a patch. Upgrade to Nextcloud Enterprise Server 25.0.1 to receive a patch. Upgrade to Nextcloud Enterprise Server 24.0.8 to receive a patch. Upgrade to Nextcloud Enterprise Server 23.0.12 to receive a patch.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2023-1055

ALT-PU-2023-1176

CVE-2023-25161

GHSA-492H-596Q-XR2F

Affected Products

Alt Linux

Nextcloud Enterprise Server

Nextcloud Server

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25161.json · Exploit
• https://github.com/nextcloud/server/pull/34632 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-596q-xr2f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25161 · Security Note
• https://hackerone.com/reports/1691195 · Note
• https://t.me/cibsecurity/58041 · Telegram Post