Lucene search
PRIOn knowledge basePRION:CVE-2023-32319HistoryMay 26, 2023 - 11:15 p.m.
Design/Logic Flaw
2023-05-2623:15:00
PRIOn knowledge base
www.prio-n.com
10
nextcloud
brute-force protection
webdav
basic auth
vulnerability
upgrade
flaw
0.001 Low
EPSS
Percentile
35.2%
Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issue has been addressed in releases 24.0.11, 25.0.5 and 26.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
| CPE | Name | Operator | Version |
|---|---|---|---|
| nextcloud_server | ge | 25.0.0 | |
| nextcloud_server | lt | 25.0.5 | |
| nextcloud_server | ge | 24.0.0 | |
| nextcloud_server | lt | 24.0.11 |
Related
cvelist
cvelist
osv
osv
CVE-2023-32319
2023-05-26 23:15:17
openvas
openvas
hackerone
hackerone
Nextcloud: Basic auth header on WebDAV requests is not bruteforce protected
2023-02-20 11:47:15
cve
cve
CVE-2023-32319
2023-05-26 23:15:17
nextcloud
nextcloud
Basic auth header on WebDAV requests is not brute-force protected
2023-05-24 09:48:39
nvd
nvd
CVE-2023-32319
2023-05-26 23:15:17