CVE-2023-45148

MEDIUM

Nextcloud Server 22.0.0-22.2.10.15 and 25.0.0-25.0.10 - Rate Limit Bypass via Memcached Distributed Cache

Title source: llm
STIX 2.1

Description

Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgrade should change their config setting `memcache.distributed` to `\OC\Memcache\Redis` and install Redis instead of Memcached.

References (3)

Core 3
Core References
Issue Tracking, Patch x_refsource_misc
https://github.com/nextcloud/server/pull/40293
Permissions Required x_refsource_misc
https://hackerone.com/reports/2110945

Scores

CVSS v3 4.3
EPSS 0.0018
EPSS Percentile 38.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-307
Status published
Products (3)
nextcloud/nextcloud_server 27.0.0 (2 CPE variants)
nextcloud/nextcloud_server 22.0.0 - 22.2.10.16
nextcloud/nextcloud_server 25.0.0 - 25.0.11
Published Oct 16, 2023
Tracked Since Feb 18, 2026