What is the vulnerability ID for this Nextcloud Server vulnerability?

The vulnerability ID for this Nextcloud Server vulnerability is CVE-2023-25161.

What is the severity level of CVE-2023-25161?

The severity level of CVE-2023-25161 is medium, with a CVSS score of 5.3.

What is the affected software version range for CVE-2023-25161?

The affected software version range for CVE-2023-25161 is from versions 23.0.12 to 25.0.0 (inclusive).

What is the impact of CVE-2023-25161?

CVE-2023-25161 can result in service slowdown and storage overflow due to missing rate limiting on password reset functionality.

Are there any references available for CVE-2023-25161?

Yes, you can find references for CVE-2023-25161 at the following links: [1](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-596q-xr2f), [2](https://github.com/nextcloud/server/pull/34632), [3](https://hackerone.com/reports/1691195).

Vulnerability/
CVE-2023-25161

medium

5.3

CWE

284

13/2/2023

2/8/2024

CVE-2023-25161: Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails

First published: Mon Feb 13 2023(Updated: )

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known workarounds are available.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Nextcloud Nextcloud Server	<23.0.12
Nextcloud Nextcloud Server	>=24.0.0<24.0.8
Nextcloud Nextcloud Server	=25.0.0

Remedy

https://github.com/nextcloud/server/pull/34632

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the vulnerability ID for this Nextcloud Server vulnerability?
The vulnerability ID for this Nextcloud Server vulnerability is CVE-2023-25161.
What is the severity level of CVE-2023-25161?
The severity level of CVE-2023-25161 is medium, with a CVSS score of 5.3.
What is the affected software version range for CVE-2023-25161?
The affected software version range for CVE-2023-25161 is from versions 23.0.12 to 25.0.0 (inclusive).
What is the impact of CVE-2023-25161?
CVE-2023-25161 can result in service slowdown and storage overflow due to missing rate limiting on password reset functionality.
Are there any references available for CVE-2023-25161?
Yes, you can find references for CVE-2023-25161 at the following links: [1](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-596q-xr2f), [2](https://github.com/nextcloud/server/pull/34632), [3](https://hackerone.com/reports/1691195).

collector/nvd-index
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/weakness
agent/remedy
agent/severity
agent/author
agent/last-modified-date
agent/references
agent/title
agent/tags
agent/event
agent/description
agent/first-publish-date
vendor/nextcloud
canonical/nextcloud nextcloud server
version/nextcloud nextcloud server/24.0.0
version/nextcloud nextcloud server/25.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.