CVE-2025-47791CWE-918

Nextcloud Server's test remote endpoint is not rate limited

Medium · published May 16, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0.13, 29.0.10, and 30.0.3. No known workarounds are available.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00380 · 30.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-05-16T14:09Z
EPSS history
Timeline
  • 16 MAY 14:09Z
    Nextcloud Server's test remote endpoint is not rate limited
    cvelistv5