CVE-2023-45148

2023-10-1619:15:10

Google

osv.dev

nextcloud

home cloud server

rate limiting

memcached

upgrade

redis

software

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

Confidence

High

EPSS

0.001

Percentile

27.8%

JSON

Nextcloud is an open source home cloud server. When Memcached is used as memcache.distributed the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgrade should change their config setting memcache.distributed to \OC\Memcache\Redis and install Redis instead of Memcached.