CVEvulnerability

CVE-2023-49792

9.8 CRITICAL Published 2023-12-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-12-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-307

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing them executing authentication attempts than intended. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

Affected configurations

• nextcloud nextcloud server (>= 23.0.0 < 23.0.12.13) • nextcloud nextcloud server (>= 24.0.0 < 24.0.12.9) • nextcloud nextcloud server (>= 25.0.0 < 25.0.13.4) • nextcloud nextcloud server (>= 26.0.0 < 26.0.9) • nextcloud nextcloud server (>= 27.0.0 < 27.1.4)

Related

Weakness · CWE (1)

  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References