Vulnerability · Published Jun 22, 2023 · Assigned by GitHub_M
CVE-2023-32320Nextcloud Server's brute force protection allows someone to send more requests than intended
High 8.7
In plain English
A high-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty requests succeeded the limit by the time the response was sent to the client. This allowed someone to send as many requests the server could handle in parallel to bruteforce protected details instead of the configured limit, default 8. Nextcloud Server versions 25.0.7 and 26.0.2 and Nextcloud Enterprise Server versions 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7 and 26.0.2 contain patches for this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | Nextcloud Server >= 25.0.0, < 25.0.7Nextcloud Server >= 26.0.0, < 26.0.2Nextcloud Enterprise Server >= 21.0.0, < 21.0.9.12Nextcloud Enterprise Server >= 22.0.0, < 22.2.10.12Nextcloud Enterprise Server >= 23.0.0, < 23.0.12.7Nextcloud Enterprise Server >= 24.0.0, < 24.0.12.2Nextcloud Enterprise Server >= 25.0.0, < 25.0.7Nextcloud Enterprise Server >= 26.0.0, < 26.0.2 |
Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qphh-6xh7-vffg x_refsource_CONFIRM
- https://github.com/nextcloud/server/pull/38274 x_refsource_MISC
- https://hackerone.com/reports/1918525 x_refsource_MISC