CVE-2023-39960

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	>= 22.0.0, < 22.2.10.14; >= 23.0.0, < 23.0.12.9; >= 24.0.0, < 24.0.12.5; >= 25.0.0, < 25.0.9; >= 26.0.0, < 26.0.4

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9Vendor Advisory
https://github.com/nextcloud/server/pull/38046Issue Tracking, Patch
https://hackerone.com/reports/1924212Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9Vendor Advisory
https://github.com/nextcloud/server/pull/38046Issue Tracking, Patch
https://hackerone.com/reports/1924212Third Party Advisory

Timeline

Published: Oct 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-399614.3Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9 CVE-2023-399627.7Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.1 CVE-2023-399637.8Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.1 CVE-2023-399647.51Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker t CVE-2023-399654.31Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arb CVE-2023-399669.81Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability co CVE-2023-3996710.0WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fie CVE-2023-399686.1jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Se CVE-2023-399699.8uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Version 1.0.9 of uthenticode hashed t CVE-2023-39977.8Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third par CVE-2023-399709.8Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution.CVE-2023-399716.1Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This iss