CVE-2023-28847: Nextcloud Server missing brute force protection for passwords of password protected share links
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server Enterprise 23.0.0 prior to 23.0.12.6, 24.0.0 prior to 24.0.11, and 25.0.0 prior to 25.0.5; an attacker is not restricted in verifying passwords of share links so they can just start brute forcing the password. Nextcloud Server 24.0.11 and 25.0.5 and Nextcloud Enterprise Server 23.0.12.6, 24.0.11, and 25.0.5 contain a fix for this issue. No known workarounds are available.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-28847?
CVE-2023-28847 is a vulnerability in Nextcloud Server that allows an attacker to execute arbitrary code on the server.
How severe is CVE-2023-28847?
CVE-2023-28847 has a severity rating of 7.5, which is considered high.
Which versions of Nextcloud Server are affected by CVE-2023-28847?
Nextcloud Server versions 24.0.0 to 24.0.11 and 25.0.0 to 25.0.5, as well as Nextcloud Server Enterprise versions 23.0.0 to 23.0.12.6, 24.0.0 to 24.0.11, and 25.0.0 to 25.0.5 are affected by CVE-2023-28847.
How can I fix CVE-2023-28847?
To fix CVE-2023-28847, you should update Nextcloud Server to version 24.0.11 or later, or version 25.0.5 or later.
Where can I find more information about CVE-2023-28847?
More information about CVE-2023-28847 can be found on the Nextcloud security advisories page, GitHub pull request, and HackerOne report linked in the references.