Improper Restriction of Excessive Authentication Attempts in Nextcloud Enterprise Server and Nextcloud Server - CVE-2023-45148

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper rate limiter when Memcached is installed. A remote user can cause the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended.

Affected software

How to mitigate CVE-2023-45148

External References

• https://github.com/nextcloud/server/pull/40293
• https://hackerone.com/reports/2110945
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xmhp-7vr4-hp63

Related Security Bulletins

• Improper Restriction of Excessive Authentication Attempts in Nextcloud Server and Enterprise Server