Vulnerability · Published Feb 13, 2023 · Assigned by GitHub_M

CVE-2023-25161Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails

Low 3.7

In plain English

A low-severity improper access control in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.7%top 45.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known workarounds are available.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	= 25.0.0>= 24.0.0, < 24.0.8< 23.0.2

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-596q-xr2f x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/34632 x_refsource_MISC
https://hackerone.com/reports/1691195 x_refsource_MISC