Riskcovery

CVE-2023-35172

Nextcloud Server password reset endpoint is not brute force protected

State
Published
Severity
8.7 High
Published
Jun 23, 2023
Updated
Dec 5, 2024
Reserved
Jun 14, 2023

Read the record on cve.org

Description

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can bruteforce the password reset links. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. No known workarounds are available.

Scores

CVSSScoreVectorSource
3.18.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NGitHub_M

Weaknesses

  • CWE-307 Improper Restriction of Excessive Authentication Attempts

Affected Products

ProductVersions
security-advisoriesnextcloud
  • Nextcloud Server >= 25.0.0, < 25.0.7Affected
  • Nextcloud Server >= 26.0.0, < 26.0.2Affected
  • Nextcloud Enterprise Server >= 25.0.0, < 25.0.7Affected
  • Nextcloud Enterprise Server >= 26.0.0, < 26.0.2Affected
  • Nextcloud Enterprise Server >= 21.0.0, < 21.0.9.12Affected
  • Nextcloud Enterprise Server >= 22.0.0, < 22.2.10.12Affected
  • Nextcloud Enterprise Server >= 23.0.0, < 23.0.12.7Affected
  • Nextcloud Enterprise Server >= 24.0.0, < 24.0.12.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.