Improper access control in Nextcloud Enterprise Server and Nextcloud Server - CVE-2023-25161
Published: February 22, 2023
Vulnerability identifier: #VU72493
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-25161
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in the password reset functionality. A remote attacker can send lots of emails, leading to service slowdown, storage overflow and cost impact when using external email services.
Affected software
Nextcloud Enterprise Server
Nextcloud Server
Nextcloud Server
How to mitigate CVE-2023-25161
Install updates from vendor's website.
Nextcloud Enterprise Server - addressed in versions 23.0.12, 24.0.8, 25.0.1
Nextcloud Server - addressed in versions 23.0.12, 24.0.8, 25.0.1
Nextcloud Server - addressed in versions 23.0.12, 24.0.8, 25.0.1