CVE-2023-45148: Nextcloud is an open source home cloud server

Medium severity · published Oct 16, 2023

CVE-2023-45148

Nextcloud is an open source home cloud server

4.3

CVSS

0.9%

EPSS

On KEV

Description

Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgrade should change their config setting `memcache.distributed` to `\OC\Memcache\Redis` and install Redis instead of Memcached.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

None

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.9% · higher than 59% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Nextcloud Server · Nextcloud

22.0.0 before 22.2.10.16; 23.0.0 before 23.0.12.11; 24.0.0 before 24.0.12.7; 25.0.0 before 25.0.11; 25.0.0 before 25.0.11; 26.0.0 before 26.0.6; +3 more · source: NVD

Affected product

Nextcloud Server

Nextcloud

All Nextcloud Server CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-45148

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-45148

Vendor Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xmhp-7vr4-hp63

Issue Tracking

https://github.com/nextcloud/server/pull/40293

Permissions Required

https://hackerone.com/reports/2110945