Vulnerability in Nextcloud Server
CVE-2023-35172
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can bruteforce the password reset links. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. No known workarounds are available.
EPSS: 0.009 (57.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Nextcloud Nextcloud_server
- Nextcloud Security-advisories — versions Nextcloud Server >= 25.0.0, < 25.0.7, Nextcloud Server >= 26.0.0, < 26.0.2, Nextcloud Enterprise Server >= 25.0.0, < 25.0.7
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Permissions Required, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-35172?
- CVE-2023-35172 is a high-severity vulnerability in Nextcloud Server, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 8.7/10. Published 2023-06-23.
- How severe is CVE-2023-35172?
- High severity. CVSS v3 base score is 8.7 out of 10.