CVSS: 8.5EPSS: 0%CPEs: 11EXPL: 1CVE-2023-48239 – Nextcloud Server users can make external storage mount points inaccessible for other users
https://notcve.org/view.php?id=CVE-2023-48239
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Enterprise Server, a malicious user could update any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud Server 25.0.13, 26.0.8, and 27.1.3 and Nextcloud Enterprise Server is upgraded to 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 contain a patch for this issue. As a workaround, disable app files_external. This workaround also makes the external storage inaccessible but retains the configurations until a patched version has been deployed. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f962-hw26-g267 https://github.com/nextcloud/server/pull/41123 https://hackerone.com/reports/2212627 • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0CVE-2023-45148 – Rate limiter not working reliable when Memcached is installed in Nextcloud
https://notcve.org/view.php?id=CVE-2023-45148
Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgrade should change their config setting `memcache.distributed` to `\OC\Memcache\Redis` and install Redis instead of Memcached. Nextcloud es un servidor en la nube doméstico de código abierto. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xmhp-7vr4-hp63 https://github.com/nextcloud/server/pull/40293 https://hackerone.com/reports/2110945 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-45151 – OAuth2 client_secret stored in plain text in the Nextcloud database
https://notcve.org/view.php?id=CVE-2023-45151
Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this vulnerability. El servidor Nextcloud es una plataforma de nube doméstica de código abierto. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hhgv-jcg9-p4m9 https://github.com/nextcloud/server/pull/38398 https://hackerone.com/reports/1994324 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2023-39960 – Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint
https://notcve.org/view.php?id=CVE-2023-39960
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available. Nextcloud Server proporciona almacenamiento de datos para Nextcloud, una plataforma en la nube de código abierto. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9 https://github.com/nextcloud/server/pull/38046 https://hackerone.com/reports/1924212 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 8.1EPSS: 0%CPEs: 11EXPL: 0CVE-2023-39963 – Missing password confirmation when creating app passwords
https://notcve.org/view.php?id=CVE-2023-39963
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully stealing a session from a logged in user, to create app passwords for the victim. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j4qm-5q5x-54m5 https://github.com/nextcloud/server/pull/39416 https://hackerone.com/reports/2067572 • CWE-284: Improper Access Control •