PT-2023-20326 · Nextcloud+1 · Nextcloud Enterprise Server+2

Hackit_Bharat · Published 2023-03-22 · Updated 2023-03-31 · CVE-2023-25820

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions 24.0.x through 24.0.9 Nextcloud Server versions 25.0.x through 25.0.4 Nextcloud Enterprise Server versions 21.x through 21.0.9.9 Nextcloud Enterprise Server versions 22.x through 22.2.0.9 Nextcloud Enterprise Server versions 23.0.x through 23.0.12.4 Nextcloud Enterprise Server versions 24.0.x through 24.0.9 Nextcloud Enterprise Server versions 25.0.x through 25.0.3

Description The issue affects Nextcloud Server and Nextcloud Enterprise Server, where an attacker who gains access to an already logged-in user session can brute force the password on the confirmation endpoint.

Recommendations For Nextcloud Server versions 24.0.x through 24.0.9, upgrade to version 24.0.10 or 25.0.5. For Nextcloud Server versions 25.0.x through 25.0.4, upgrade to version 25.0.5. For Nextcloud Enterprise Server versions 21.x through 21.0.9.9, upgrade to version 21.0.9.10. For Nextcloud Enterprise Server versions 22.x through 22.2.0.9, upgrade to version 22.2.0.10. For Nextcloud Enterprise Server versions 23.0.x through 23.0.12.4, upgrade to version 23.0.12.5. For Nextcloud Enterprise Server versions 24.0.x through 24.0.9, upgrade to version 24.0.10. For Nextcloud Enterprise Server versions 25.0.x through 25.0.3, upgrade to version 25.0.4.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

ALT-PU-2023-1517

ALT-PU-2023-1547

CVE-2023-25820

GHSA-36G6-WJX2-333X

Affected Products

Alt Linux

Nextcloud Enterprise Server

Nextcloud Server

References · 30

• 🔥 https://github.com/rapid7/metasploit-framework/commit/c598d8b4b00581ff801cdcb3e79f8de056adf6b8 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25818.json · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25820.json · Exploit
• https://github.com/nextcloud/server/pull/36489 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-36g6-wjx2-333x · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26482 · Security Note
• https://bdu.fstec.ru/vul/2023-02259 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30539 · Security Note
• https://bdu.fstec.ru/vul/2024-00711 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25820 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02258 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28847 · Security Note
• https://errata.altlinux.org/ALT-PU-2023-1547 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28835 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25818 · Security Note