CVSS: 9.1EPSS: 0%CPEs: 8EXPL: 0CVE-2023-35172 – Nextcloud Server password reset endpoint is not brute force protected
https://notcve.org/view.php?id=CVE-2023-35172
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can bruteforce the password reset links. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. No known workarounds are available. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mjf5-p765-qmr6 https://github.com/nextcloud/server/pull/38267 https://hackerone.com/reports/1987062 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 8.7EPSS: 0%CPEs: 8EXPL: 0CVE-2023-32320 – Nextcloud Server's brute force protection allows someone to send more requests than intended
https://notcve.org/view.php?id=CVE-2023-32320
Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty requests succeeded the limit by the time the response was sent to the client. This allowed someone to send as many requests the server could handle in parallel to bruteforce protected details instead of the configured limit, default 8. Nextcloud Server versions 25.0.7 and 26.0.2 and Nextcloud Enterprise Server versions 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7 and 26.0.2 contain patches for this issue. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qphh-6xh7-vffg https://github.com/nextcloud/server/pull/38274 https://hackerone.com/reports/1918525 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-32319 – Basic auth header on WebDAV requests is not brute-force protected in Nextcloud
https://notcve.org/view.php?id=CVE-2023-32319
Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issue has been addressed in releases 24.0.11, 25.0.5 and 26.0.0. Users are advised to upgrade. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mr7q-xf62-fw54 https://github.com/nextcloud/server/pull/37227 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2023-28847 – Nextcloud Server missing brute force protection for passwords of password protected share links
https://notcve.org/view.php?id=CVE-2023-28847
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server Enterprise 23.0.0 prior to 23.0.12.6, 24.0.0 prior to 24.0.11, and 25.0.0 prior to 25.0.5; an attacker is not restricted in verifying passwords of share links so they can just start brute forcing the password. Nextcloud Server 24.0.11 and 25.0.5 and Nextcloud Enterprise Server 23.0.12.6, 24.0.11, and 25.0.5 contain a fix for this issue. No known workarounds are available. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r5wf-xj97-3w7w https://github.com/nextcloud/server/pull/35057 https://hackerone.com/reports/1894653 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 8.8EPSS: 0%CPEs: 13EXPL: 0CVE-2023-30539 – Users can set up workflows using restricted and invisible system tags in Nextcloud
https://notcve.org/view.php?id=CVE-2023-30539
Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Server is upgraded to 24.0.11 or 25.0.5, the Nextcloud Enterprise Server to 21.0.9.11, 22.2.10.11, 23.0.12.6, 24.0.11 or 25.0.5, and the Nextcloud Files automated tagging app to 1.11.1, 1.12.1, 1.13.1, 1.14.2, 1.15.3 or 1.16.1. Users unable to upgrade should disable all workflow related apps. Users are advised to upgrade. • https://github.com/nextcloud/files_automatedtagging/pull/705 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m2f-v8x7-9w99 https://github.com/nextcloud/server/pull/37252 https://hackerone.com/reports/1895976 • CWE-284: Improper Access Control •