CVE-2023-49792

Bruteforce protection can be bypassed with misconfigured proxy

State: Published
Severity: 5.3 Medium
Published: Dec 22, 2023
Updated: Aug 27, 2024
Reserved: Nov 30, 2023

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing them executing authentication attempts than intended. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	GitHub_M

Weaknesses

CWE-307 Improper Restriction of Excessive Authentication Attempts

Affected Products

Product	Versions
security-advisoriesnextcloud	>= 23.0.0, < 23.0.12.13Affected >= 24.0.0, < 24.0.12.9Affected >= 25.0.0, < 25.0.13.4Affected >= 26.0.0, < 26.0.9Affected >= 27.0.0, < 27.1.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.