CVE-2023-39960

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
GitHub_MCNA
5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
VendorProductVersion
nextcloudnextcloud_server
22.0.0 ≤
𝑥
< 22.2.10.14
nextcloudnextcloud_server
23.0.0 ≤
𝑥
< 23.0.12.9
nextcloudnextcloud_server
24.0.0 ≤
𝑥
< 24.0.12.5
nextcloudnextcloud_server
25.0.0 ≤
𝑥
< 25.0.9
nextcloudnextcloud_server
25.0.0 ≤
𝑥
< 25.0.9
nextcloudnextcloud_server
26.0.0 ≤
𝑥
< 26.0.4
nextcloudnextcloud_server
26.0.0 ≤
𝑥
< 26.0.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9
https://github.com/nextcloud/server/pull/38046
https://hackerone.com/reports/1924212
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9
https://github.com/nextcloud/server/pull/38046
https://hackerone.com/reports/1924212