DescriptionNextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prior to 24.0.10 as well as Nextcloud Enterprise Server versions 25.0.x prior to 25.0.4, 24.0.x prior to 24.0.10, 23.0.x prior to 188.8.131.52, 22.x prior to 184.108.40.206, and 21.x prior to 220.127.116.11, when an attacker gets access to an already logged in user session they can then brute force the password on the confirmation endpoint. Nextcloud Server should upgraded to 24.0.10 or 25.0.4 and Nextcloud Enterprise Server should upgraded to 18.104.22.168, 22.214.171.124, 126.96.36.199, 24.0.10, or 25.0.4 to receive a patch. No known workarounds are available.
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having moderate severity.
|National Vulnerability Database|
SUSE Timeline for this CVECVE page created: Wed Mar 22 21:01:14 2023
CVE page last modified: Tue Mar 28 13:49:20 2023