CVE-2023-39960

published 2023-10-13

CVE-2023-39960: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as…

Priority P3 44 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
nextcloud	nextcloud_server	>= 22.0.0 < 22.2.10.14	22.2.10.14
nextcloud	nextcloud_server	>= 23.0.0 < 23.0.12.9	23.0.12.9
nextcloud	nextcloud_server	>= 24.0.0 < 24.0.12.5	24.0.12.5
nextcloud	nextcloud_server	>= 25.0.0 < 25.0.9	25.0.9
nextcloud	nextcloud_server	>= 26.0.0 < 26.0.4	26.0.4
nextcloud	security-advisories	—	—
nextcloud	security-advisories	—	—
nextcloud	security-advisories	—	—
nextcloud	security-advisories	—	—
nextcloud	security-advisories	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-307