PT-2023-23726 · Nextcloud+1 · Nextcloud Server+1

Hackitbharat · Published 2023-03-27 · Updated 2023-12-07 · CVE-2023-32319

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud server versions 24.0.0 through 24.0.10 Nextcloud server versions 25.0.0 through 25.0.4 Nextcloud server versions prior to 26.0.0

Description The issue is related to missing brute-force protection on the WebDAV endpoints via the basic auth header, allowing brute-forcing of user credentials when the provided user name was not an email address.

Recommendations For Nextcloud server versions 24.0.0 through 24.0.10, upgrade to version 24.0.11 or later. For Nextcloud server versions 25.0.0 through 25.0.4, upgrade to version 25.0.5 or later. For Nextcloud server versions prior to 26.0.0, upgrade to version 26.0.0 or later.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

ALT-PU-2023-1517

ALT-PU-2023-1547

ALT-PU-2023-7785

CVE-2023-32319

GHSA-MR7Q-XF62-FW54

Affected Products

Alt Linux

Nextcloud Server

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32319.json · Exploit
• https://github.com/nextcloud/server/pull/37227 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mr7q-xf62-fw54 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32319 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32319 · Security Note
• https://t.me/cvenotify/51659 · Telegram Post
• https://t.me/cvenotify/51239 · Telegram Post