CVE-2023-32320
Published: Jun 22, 2023
Modified: Dec 5, 2024
CVSS v3.1
8.7
Description
Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty requests succeeded the limit by the time the response was sent to the client. This allowed someone to send as many requests the server could handle in parallel to bruteforce protected details instead of the configured limit, default 8. Nextcloud Server versions 25.0.7 and 26.0.2 and Nextcloud Enterprise Server versions 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7 and 26.0.2 contain patches for this issue.
| Vendor | Product | Versions |
|---|---|---|
nextcloud | security-advisories | affected Nextcloud Server >= 25.0.0, < 25.0.7affected Nextcloud Server >= 26.0.0, < 26.0.2affected Nextcloud Enterprise Server >= 21.0.0, < 21.0.9.12affected Nextcloud Enterprise Server >= 22.0.0, < 22.2.10.12affected Nextcloud Enterprise Server >= 23.0.0, < 23.0.12.7+3 more versions |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now