SB2023032204 - Improper Restriction of Excessive Authentication Attempts in Nextcloud Server and Enterprise Server

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2023-25820)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to improper restriction of excessive authentication attempts on password confirmation modal. A local user can brute force the password on the confirmation endpoint.

2) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2023-25818)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to missing brute force protection on password reset token. A remote attacker can reset the password of another user.

Remediation

Install update from vendor's website.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-36g6-wjx2-333x
• https://github.com/nextcloud/server/pull/36489
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v243-x6jc-42mp
• https://github.com/nextcloud/server/pull/36489/commits/704eb3aa6cecc0a646f5cca4290b595f493f9ed3