cve-2023-39960
Vulnerability from cvelistv5
Published
2023-10-13 12:07
Modified
2024-09-17 20:32
Severity ?
EPSS score ?
Summary
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | nextcloud | security-advisories |
Version: >= 22.0.0, < 22.2.10.14 Version: >= 23.0.0, < 23.0.12.9 Version: >= 24.0.0, < 24.0.12.5 Version: >= 25.0.0, < 25.0.9 Version: >= 26.0.0, < 26.0.4 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:18:10.121Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9"
},
{
"name": "https://github.com/nextcloud/server/pull/38046",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nextcloud/server/pull/38046"
},
{
"name": "https://hackerone.com/reports/1924212",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://hackerone.com/reports/1924212"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39960",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-17T20:31:46.041277Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T20:32:00.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "security-advisories",
"vendor": "nextcloud",
"versions": [
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.2.10.14"
},
{
"status": "affected",
"version": "\u003e= 23.0.0, \u003c 23.0.12.9"
},
{
"status": "affected",
"version": "\u003e= 24.0.0, \u003c 24.0.12.5"
},
{
"status": "affected",
"version": "\u003e= 25.0.0, \u003c 25.0.9"
},
{
"status": "affected",
"version": "\u003e= 26.0.0, \u003c 26.0.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-13T12:07:59.934Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9"
},
{
"name": "https://github.com/nextcloud/server/pull/38046",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextcloud/server/pull/38046"
},
{
"name": "https://hackerone.com/reports/1924212",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/1924212"
}
],
"source": {
"advisory": "GHSA-2hrc-5fgp-c9c9",
"discovery": "UNKNOWN"
},
"title": "Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-39960",
"datePublished": "2023-10-13T12:07:59.934Z",
"dateReserved": "2023-08-07T16:27:27.076Z",
"dateUpdated": "2024-09-17T20:32:00.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*\", \"versionStartIncluding\": \"22.0.0\", \"versionEndExcluding\": \"22.2.10.14\", \"matchCriteriaId\": \"916FDFBE-023F-4EC1-947B-8B2F2A0E5E84\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*\", \"versionStartIncluding\": \"23.0.0\", \"versionEndExcluding\": \"23.0.12.9\", \"matchCriteriaId\": \"881A0D0D-1888-43D8-A22C-FD38D28EB601\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*\", \"versionStartIncluding\": \"24.0.0\", \"versionEndExcluding\": \"24.0.12.5\", \"matchCriteriaId\": \"B2AF81DA-6377-4051-AF70-141FC50E049F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*\", \"versionStartIncluding\": \"25.0.0\", \"versionEndExcluding\": \"25.0.9\", \"matchCriteriaId\": \"623D58E0-57A0-42B3-8ED6-DF3B988633AB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*\", \"versionStartIncluding\": \"25.0.0\", \"versionEndExcluding\": \"25.0.9\", \"matchCriteriaId\": \"D60D3184-C289-49E8-9FBE-EDA8B927131A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*\", \"versionStartIncluding\": \"26.0.0\", \"versionEndExcluding\": \"26.0.4\", \"matchCriteriaId\": \"CA187E45-EB4B-468A-9291-FD66B360B2D6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*\", \"versionStartIncluding\": \"26.0.0\", \"versionEndExcluding\": \"26.0.4\", \"matchCriteriaId\": \"2D0FA653-A595-4EC8-9F77-0AD1A4699B07\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available.\"}, {\"lang\": \"es\", \"value\": \"Nextcloud Server proporciona almacenamiento de datos para Nextcloud, una plataforma en la nube de c\\u00f3digo abierto. En Nextcloud Server a partir de la versi\\u00f3n 25.0.0 y anteriores a las 25.09 y 26.04; as\\u00ed como Nextcloud Enterprise Server a partir de la versi\\u00f3n 22.0.0 y anteriores a las 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9 y 26.0.4; La falta de protecci\\u00f3n permite a un atacante forzar contrase\\u00f1as de fuerza bruta en la API WebDAV. Nextcloud Server versiones 25.0.9 y 26.0.4 y Nextcloud Enterprise Server versiones 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9 y 26.0.4 contienen parches para este problema. No se conocen workarounds disponibles.\"}]",
"id": "CVE-2023-39960",
"lastModified": "2024-11-21T08:16:07.403",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N\", \"baseScore\": 5.0, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.1, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
"published": "2023-10-13T13:15:11.560",
"references": "[{\"url\": \"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/nextcloud/server/pull/38046\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://hackerone.com/reports/1924212\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/nextcloud/server/pull/38046\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://hackerone.com/reports/1924212\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-307\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-39960\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-10-13T13:15:11.560\",\"lastModified\":\"2024-11-21T08:16:07.403\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available.\"},{\"lang\":\"es\",\"value\":\"Nextcloud Server proporciona almacenamiento de datos para Nextcloud, una plataforma en la nube de c\u00f3digo abierto. En Nextcloud Server a partir de la versi\u00f3n 25.0.0 y anteriores a las 25.09 y 26.04; as\u00ed como Nextcloud Enterprise Server a partir de la versi\u00f3n 22.0.0 y anteriores a las 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9 y 26.0.4; La falta de protecci\u00f3n permite a un atacante forzar contrase\u00f1as de fuerza bruta en la API WebDAV. Nextcloud Server versiones 25.0.9 y 26.0.4 y Nextcloud Enterprise Server versiones 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9 y 26.0.4 contienen parches para este problema. No se conocen workarounds disponibles.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N\",\"baseScore\":5.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-307\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"22.0.0\",\"versionEndExcluding\":\"22.2.10.14\",\"matchCriteriaId\":\"916FDFBE-023F-4EC1-947B-8B2F2A0E5E84\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"23.0.0\",\"versionEndExcluding\":\"23.0.12.9\",\"matchCriteriaId\":\"881A0D0D-1888-43D8-A22C-FD38D28EB601\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"24.0.0\",\"versionEndExcluding\":\"24.0.12.5\",\"matchCriteriaId\":\"B2AF81DA-6377-4051-AF70-141FC50E049F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"25.0.0\",\"versionEndExcluding\":\"25.0.9\",\"matchCriteriaId\":\"623D58E0-57A0-42B3-8ED6-DF3B988633AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"25.0.0\",\"versionEndExcluding\":\"25.0.9\",\"matchCriteriaId\":\"D60D3184-C289-49E8-9FBE-EDA8B927131A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"26.0.0\",\"versionEndExcluding\":\"26.0.4\",\"matchCriteriaId\":\"CA187E45-EB4B-468A-9291-FD66B360B2D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"26.0.0\",\"versionEndExcluding\":\"26.0.4\",\"matchCriteriaId\":\"2D0FA653-A595-4EC8-9F77-0AD1A4699B07\"}]}]}],\"references\":[{\"url\":\"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/nextcloud/server/pull/38046\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://hackerone.com/reports/1924212\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/nextcloud/server/pull/38046\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://hackerone.com/reports/1924212\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9\", \"name\": \"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/nextcloud/server/pull/38046\", \"name\": \"https://github.com/nextcloud/server/pull/38046\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://hackerone.com/reports/1924212\", \"name\": \"https://hackerone.com/reports/1924212\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T18:18:10.121Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-39960\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-17T20:31:46.041277Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-17T20:31:56.707Z\"}}], \"cna\": {\"title\": \"Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint\", \"source\": {\"advisory\": \"GHSA-2hrc-5fgp-c9c9\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"nextcloud\", \"product\": \"security-advisories\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 22.0.0, \u003c 22.2.10.14\"}, {\"status\": \"affected\", \"version\": \"\u003e= 23.0.0, \u003c 23.0.12.9\"}, {\"status\": \"affected\", \"version\": \"\u003e= 24.0.0, \u003c 24.0.12.5\"}, {\"status\": \"affected\", \"version\": \"\u003e= 25.0.0, \u003c 25.0.9\"}, {\"status\": \"affected\", \"version\": \"\u003e= 26.0.0, \u003c 26.0.4\"}]}], \"references\": [{\"url\": \"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9\", \"name\": \"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/nextcloud/server/pull/38046\", \"name\": \"https://github.com/nextcloud/server/pull/38046\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://hackerone.com/reports/1924212\", \"name\": \"https://hackerone.com/reports/1924212\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-307\", \"description\": \"CWE-307: Improper Restriction of Excessive Authentication Attempts\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-10-13T12:07:59.934Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-39960\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-17T20:32:00.464Z\", \"dateReserved\": \"2023-08-07T16:27:27.076Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-10-13T12:07:59.934Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.