CVE-2023-25818

Katalog CVE

CVSS 7.1 · High EPSS 0,60%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada nextcloud server. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations for the password reset token. As of commit `704eb3aa` password reset attempts are now throttled. Note that 62^21 combinations would significant compute resources to brute force. None the less it is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

27 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v243-x6jc-42mp advisory vendor
• https://github.com/nextcloud/server/pull/36489/commits/704eb3aa6cecc0a646f5cca4290b595f493f9ed3 patch
• https://github.com/nextcloud/server/pull/36489 issue tracking