CVE-2023-32319(nextcloud / nextcloud_server)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issue has been addressed in releases 24.0.11, 25.0.5 and 26.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

nextcloud CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

Weakness type (CWE)

CWE-307

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

nextcloud_server

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Affected systems

Vendors

nextcloud

Products

nextcloud_server

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

General Intels Daily@intels_daily1d
🔴 𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 · 𝗖𝗹𝗮𝗶𝗺𝗲𝗱 𝘁𝗵𝗿𝗲𝗮𝘁 𝗮𝗰𝘁𝗶𝘃𝗶𝘁𝘆 🏢 Attributed to: 𝗞𝗲𝗺𝗲𝗻𝗱𝗮𝗴𝗿𝗶 👤 Actor: marlanwg 🧩 Products: 𝗥𝘂𝗶𝗷𝗶𝗲 𝗡𝗕𝗦𝟯𝟭𝟬𝟬-𝟮𝟰𝗚𝗧𝟰𝗦𝗙𝗣-𝗣, 𝗭𝗮𝗯𝗯𝗶𝘅 𝟳.𝟬.𝟲, 𝗠𝗶𝗻𝗜𝗢 𝗖𝗼𝗻𝘀𝗼𝗹𝗲 🛡️ CVE-2023-32319, CVE-2023-32320 Threat actor 'marlanwg' posted a claim involving Kemendagri. Unverified claim. #ThreatIntel #CTI
00000144
917 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nextcloud	nextcloud_server	-	-	-

Explore more

Back to dashboard nextcloud CVEs nextcloud_server vulnerabilities