CVE-2023-25820

MEDIUM

Published 2023-03-22T18:22:54.139Z

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2023-25820. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1

4.2

/10

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Base Score Metrics

Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14

0.001

probability

of exploitation in the wild

There is a 0.1% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25

Exploit Probability

Percentile: 0.334

Higher than 33.4% of all CVEs

Attack Vector Metrics

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Impact Metrics

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prior to 24.0.10 as well as Nextcloud Enterprise Server versions 25.0.x prior to 25.0.4, 24.0.x prior to 24.0.10, 23.0.x prior to 23.0.12.5, 22.x prior to 22.2.0.10, and 21.x prior to 21.0.9.10, when an attacker gets access to an already logged in user session they can then brute force the password on the confirmation endpoint. Nextcloud Server should upgraded to 24.0.10 or 25.0.4 and Nextcloud Enterprise Server should upgraded to 21.0.9.10, 22.2.10.10, 23.0.12.5, 24.0.10, or 25.0.4 to receive a patch. No known workarounds are available.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

nextcloud

security-advisories

Affected Versions:

Nextcloud Server >= 24.0.0, < 24.0.10 Nextcloud Server >= 25.0.0, < 25.0.4 Nextcloud Enterprise Server >= 25.0.0, < 25.0.4 Nextcloud Enterprise Server >= 24.0.0, < 24.0.10 Nextcloud Enterprise Server >= 23.0.0, < 23.0.12.5 Nextcloud Enterprise Server >= 22.0.0, < 22.2.10.10 Nextcloud Enterprise Server >= 21.0.0, < 21.0.9.10

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-36g6-wjx2-333x

https://github.com/nextcloud/server/pull/36489

https://hackerone.com/reports/1842114

Published: 2023-03-22T18:22:54.139Z

Last Modified: 2025-02-25T14:51:54.712Z

Copied to clipboard!