PT-2023-2378 · Nextcloud+2 · Nextcloud+2

Aditya404 · Published 2023-01-23 · Updated 2023-04-13 · CVE-2023-25816

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Nextcloud versions 25.0.0 through 25.0.2

Description The issue is related to Uncontrolled Resource Consumption in Nextcloud, an Open Source private cloud software. A user can configure a very long password, which consumes more resources on password validation than desired, potentially leading to a denial of service. This can be exploited by a remote attacker.

Recommendations For versions 25.0.0 through 25.0.2, update to version 25.0.3 to resolve the issue. As a temporary workaround is not available, ensuring timely updates is crucial.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2023-1116

ALT-PU-2023-1176

BDU:2023-02153

CVE-2023-25816

GHSA-53Q2-CM29-7J83

Affected Products

Alt Linux

Nextcloud

Red Os

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25821.json · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41970.json · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25816.json · Exploit
• 🔥 https://hackerone.com/reports/1820864 · Exploit
• https://github.com/nextcloud/server/pull/35965 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-53q2-cm29-7j83 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02260 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25816 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25161 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25816 · Security Note
• https://bdu.fstec.ru/vul/2023-02153 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25821 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-25816 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25579 · Security Note
• https://bdu.fstec.ru/vul/2023-02152 · Security Note