CVE-2023-25161

low-risk
Published 2023-02-13

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known workarounds are available.

Do I need to act?

-
0.32% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10 Low
NETWORK / HIGH complexity

Affected Products (2)

Affected Vendors

Nextcloud

References (6)

Vendor Advisory https://github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-5...
Issue Tracking https://github.com/nextcloud/server/pull/34632
Permissions Required https://hackerone.com/reports/1691195
Vendor Advisory https://github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-5...
Issue Tracking https://github.com/nextcloud/server/pull/34632
Permissions Required https://hackerone.com/reports/1691195
21
/ 100
low-risk
Severity 13/34 · Low
Exploitability 1/34 · Minimal
Exposure 7/34 · Low