Improper Restriction of Excessive Authentication Attempts in Nextcloud Server and Enterprise Server

Published: 2023-03-22 | Updated: 2023-03-28

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2023-25820 CVE-2023-25818
CWE-ID	CWE-307
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Nextcloud Enterprise Server Client/Desktop applications / Messaging software Nextcloud Server Client/Desktop applications / Messaging software
Vendor	Nextcloud

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

Updated 28.03.2023

Added vulnerability #2

1) Improper Restriction of Excessive Authentication Attempts

EUVDB-ID: #VU73916

Risk: Low

CVSSv3.1: 3.7 [CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-25820

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

Exploit availability: No

Description

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to improper restriction of excessive authentication attempts on password confirmation modal. A local user can brute force the password on the confirmation endpoint.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Nextcloud Enterprise Server: 21.0.9.0 - 25.0.3

Nextcloud Server: 24.0.0 - 25.0.3

External links

http://github.com/nextcloud/security-advisories/security/advisories/GHSA-36g6-wjx2-333x

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Restriction of Excessive Authentication Attempts

EUVDB-ID: #VU74117

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-25818