CVE-2023-28835: Insecure randomness for default password in nextcloud
Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when the sharer did not change it the password could be guessable to an attacker willing to brute force it. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. This issue only affects users who do not have a password policy enabled, so enabling a password policy is an effective mitigation for users unable to upgrade.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-28835?
CVE-2023-28835 is a vulnerability in Nextcloud server that allows an attacker to guess the generated fallback password when creating a share.
How does CVE-2023-28835 affect Nextcloud server?
In affected versions of Nextcloud server, the generated fallback password for a share is created using a weak complexity random number generator, making it guessable to an attacker.
What is the severity of CVE-2023-28835?
The severity of CVE-2023-28835 is high, with a severity value of 7.5.
How can an attacker exploit CVE-2023-28835?
An attacker can exploit CVE-2023-28835 by brute forcing the guessable fallback password created for a share in affected versions of Nextcloud server.
How can I fix CVE-2023-28835?
To fix CVE-2023-28835, it is recommended to update Nextcloud server to a version that includes the fix for this vulnerability.