CVE-2023-39960
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-39960 is a vulnerability affecting Nextcloud Server, a data storage solution for the Nextcloud platform starting from version 25.0.0 and prior to 25.09, 26.04. Similarly, Nextcloud Enterprise Server versions from 22.0.0 to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 are also vulnerable. This issue exposes the WebDAV API to brute force password attacks. The vulnerability has been patched in Nextcloud Server 25.0.9 and 26.0.4, as well as Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4. No known workarounds exist to mitigate this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Nextcloud Server
Affected Vendors
- Nextcloud GmbH
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions