CVE-2023-25161CWE-284

Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails

Low · published February 13, 2023

CVSS v3.1
3.7
EPSS
1%
Percentile
53.7
In the wild
Unconfirmed
What it is

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known workarounds are available.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00729 · 53.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-02-13T20:22Z
EPSS history
Timeline
  • 13 FEB 20:22Z
    Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails
    cvelistv5