CVE-2023-25816: nextcloud vulnerable to Uncontrolled Resource Consumption

Q: What is the vulnerability ID for this Nextcloud vulnerability?

The vulnerability ID for this Nextcloud vulnerability is CVE-2023-25816.

Q: What is the severity of the CVE-2023-25816 vulnerability?

The severity of the CVE-2023-25816 vulnerability is medium with a CVSS score of 6.5.

Q: Which versions of Nextcloud are affected by CVE-2023-25816?

Versions 25.0.0 and above, prior to 25.0.3, are affected by CVE-2023-25816.

Q: What is the impact of the CVE-2023-25816 vulnerability?

The CVE-2023-25816 vulnerability allows a user to configure a very long password, consuming excessive resources on password validation.

Q: How can the CVE-2023-25816 vulnerability be fixed?

The CVE-2023-25816 vulnerability is fixed in Nextcloud version 25.0.3. It is recommended to update to this version to mitigate the vulnerability.

Published Feb 24, 2023

Updated

Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can configure a very long password, consuming more resources on password validation than desired. This issue is patched in 25.0.3 No workaround is available.

Affected Software

2 affected components

Nextcloud Server>=25.0.0<25.0.3

Remediation

Patch Available

https://github.com/nextcloud/server/pull/35965

Event History

Feb 24, 2023

CVE Published

via MITRE·11:17 PM

Data Sourced

via MITRE·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this Nextcloud vulnerability?

The vulnerability ID for this Nextcloud vulnerability is CVE-2023-25816.

What is the severity of the CVE-2023-25816 vulnerability?