CVE-2023-28847: Nextcloud Server missing brute force protection for passwords of password protected share links
First published: Tue Apr 25 2023(Updated: )
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server Enterprise 23.0.0 prior to 23.0.12.6, 24.0.0 prior to 24.0.11, and 25.0.0 prior to 25.0.5; an attacker is not restricted in verifying passwords of share links so they can just start brute forcing the password. Nextcloud Server 24.0.11 and 25.0.5 and Nextcloud Enterprise Server 23.0.12.6, 24.0.11, and 25.0.5 contain a fix for this issue. No known workarounds are available.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Nextcloud Server | >=23.0.0<23.0.12.6 | |
| Nextcloud Nextcloud Server | >=24.0.0<24.0.11 | |
| Nextcloud Nextcloud Server | >=24.0.0<24.0.11 | |
| Nextcloud Nextcloud Server | >=25.0.0<25.0.5 | |
| Nextcloud Nextcloud Server | >=25.0.0<25.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-28847?
CVE-2023-28847 is a vulnerability in Nextcloud Server that allows an attacker to execute arbitrary code on the server.
How severe is CVE-2023-28847?
CVE-2023-28847 has a severity rating of 7.5, which is considered high.
Which versions of Nextcloud Server are affected by CVE-2023-28847?
Nextcloud Server versions 24.0.0 to 24.0.11 and 25.0.0 to 25.0.5, as well as Nextcloud Server Enterprise versions 23.0.0 to 23.0.12.6, 24.0.0 to 24.0.11, and 25.0.0 to 25.0.5 are affected by CVE-2023-28847.
How can I fix CVE-2023-28847?
To fix CVE-2023-28847, you should update Nextcloud Server to version 24.0.11 or later, or version 25.0.5 or later.
Where can I find more information about CVE-2023-28847?
More information about CVE-2023-28847 can be found on the Nextcloud security advisories page, GitHub pull request, and HackerOne report linked in the references.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/author
- agent/title
- agent/remedy
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- agent/source
- vendor/nextcloud
- canonical/nextcloud nextcloud server
- version/nextcloud nextcloud server/23.0.0
- version/nextcloud nextcloud server/24.0.0
- version/nextcloud nextcloud server/25.0.0