CVE-2023-39960CWE-307

Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint

Medium · published October 13, 2023

CVSS v3.1
5.0
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00709 · 53.0th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2023-10-13T12:07Z
EPSS history
Timeline
  • 13 OCT 12:07Z
    Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint
    cvelistv5