VULNERABILITY INTELLIGENCE

CVE-2023-25161

CVSS score3.7 LOW

EPSS probability0.73%

CISA KEVNot currently listed

Published2023-02-13

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known workarounds are available.

Weakness classification

security-advisories@github.com: CWE-284
nvd@nist.gov: NVD-CWE-noinfo

Primary references

security-advisories@github.com — Vendor Advisory
security-advisories@github.com — Issue Tracking, Patch
security-advisories@github.com — Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Third Party Advisory