Riskcovery

CVE-2023-32320

Nextcloud Server's brute force protection allows someone to send more requests than intended

State
Published
Severity
8.7 High
Published
Jun 22, 2023
Updated
Dec 5, 2024
Reserved
May 8, 2023

Read the record on cve.org

Description

Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty requests succeeded the limit by the time the response was sent to the client. This allowed someone to send as many requests the server could handle in parallel to bruteforce protected details instead of the configured limit, default 8. Nextcloud Server versions 25.0.7 and 26.0.2 and Nextcloud Enterprise Server versions 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7 and 26.0.2 contain patches for this issue.

Scores

CVSSScoreVectorSource
3.18.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NGitHub_M

Weaknesses

  • CWE-307 Improper Restriction of Excessive Authentication Attempts

Affected Products

ProductVersions
security-advisoriesnextcloud
  • Nextcloud Server >= 25.0.0, < 25.0.7Affected
  • Nextcloud Server >= 26.0.0, < 26.0.2Affected
  • Nextcloud Enterprise Server >= 21.0.0, < 21.0.9.12Affected
  • Nextcloud Enterprise Server >= 22.0.0, < 22.2.10.12Affected
  • Nextcloud Enterprise Server >= 23.0.0, < 23.0.12.7Affected
  • Nextcloud Enterprise Server >= 24.0.0, < 24.0.12.2Affected
  • Nextcloud Enterprise Server >= 25.0.0, < 25.0.7Affected
  • Nextcloud Enterprise Server >= 26.0.0, < 26.0.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.