CVE-2023-39958

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-39958
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-39958.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-39958
Aliases
  • GHSA-vv27-g2hq-v48h
Published
2023-08-10T17:04:51.729Z
Modified
2026-05-15T11:54:11.515430540Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Missing brute force protection on password reset token OAuth2 API controller
Details

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "22.0.0"
                },
                {
                    "fixed": "22.2.10.13"
                },
                {
                    "introduced": "23.0.0"
                },
                {
                    "fixed": "23.0.12.8"
                },
                {
                    "introduced": "24.0.0"
                },
                {
                    "fixed": "24.0.12.5"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-307"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39958.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages