CVE-2023-25820

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prior to 24.0.10 as well as Nextcloud Enterprise Server versions 25.0.x prior to 25.0.4, 24.0.x prior to 24.0.10, 23.0.x prior to 23.0.12.5, 22.x prior to 22.2.0.10, and 21.x prior to 21.0.9.10, when an attacker gets access to an already logged in user session they can then brute force the password on the confirmation endpoint. Nextcloud Server should upgraded to 24.0.10 or 25.0.4 and Nextcloud Enterprise Server should upgraded to 21.0.9.10, 22.2.10.10, 23.0.12.5, 24.0.10, or 25.0.4 to receive a patch. No known workarounds are available.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published
Mar 22, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-258217.5Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contaCVE-2023-258226.5ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the `com.epam.reportportal:service-api` module, corresponCVE-2023-258239.8Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contCVE-2023-258247.5Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read oCVE-2023-258256.1ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. VersioCVE-2023-258269.8Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multipleCVE-2023-258276.1Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possibCVE-2023-258287.2Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to createCVE-2023-258296.1There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker toCVE-2023-258310.0Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3.CVE-2023-258306.1There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attackeCVE-2023-258316.1There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker