CVE-2023-32319

HIGH

Nextcloud Server 24.0.0-24.0.10 - Unauthenticated Brute-Force Attack via WebDAV Basic Auth Header

Title source: llm

Description

Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issue has been addressed in releases 24.0.11, 25.0.5 and 26.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mr7q-xf62-fw54

Patch x_refsource_misc

https://github.com/nextcloud/server/pull/37227

Scores

CVSS v3 8.1

EPSS 0.0025

EPSS Percentile 48.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-307

Status published

Products (1)

nextcloud/nextcloud_server 24.0.0 - 24.0.11

Published May 26, 2023

Tracked Since Feb 18, 2026