Nextcloud Server's brute force protection allows someone to send more requests than intended
CVE-2023-32320
What is CVE-2023-32320?
Nextcloud Server, a self-hosted productivity platform, contains a vulnerability that allows multiple parallel requests to be executed simultaneously. This flaw occurs when the number of faulty requests surpasses the set limit by the time a response is returned to the client. Consequently, an attacker can exploit this by sending numerous requests to the server, thereby circumventing the default limit of 8 attempts. Versions 25.0.7, 26.0.2 of Nextcloud Server and 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2 of the Nextcloud Enterprise Server have received patches to mitigate this issue.
Affected Version(s)
security-advisories Nextcloud Server >= 25.0.0, < 25.0.7 < Nextcloud Server 25.0.0, 25.0.7
security-advisories Nextcloud Server >= 26.0.0, < 26.0.2 < Nextcloud Server 26.0.0, 26.0.2
security-advisories Nextcloud Enterprise Server >= 21.0.0, < 21.0.9.12 < Nextcloud Enterprise Server 21.0.0, 21.0.9.12