Description

Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection.

Related CPE's

a

nextcloud

nextcloud_server

3

o

fedoraproject

fedora

2

References

https://hackerone.com/reports/1154003

Permissions RequiredThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGXGR6HYGQ6MZXISMJEHCOXRGRFRUFMA/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6BO6P6MP2MOWA6PZRXX32PLWPXN5O4S/

https://nextcloud.com/security/advisory/?id=NC-SA-2021-009

Broken Link

Weaknesses

[email protected]

Primary
CWE-307

[email protected]

Secondary
CWE-307

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2021-06-11T16:15:11.913

3 years ago

Last modified

2023-11-07T03:30:28.320

1 year ago