阿里云漏洞库

漏洞描述

Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6w9...
https://github.com/nextcloud/server/pull/33052
https://hackerone.com/reports/1588562
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...

受影响软件情况

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	nextcloud	nextcloud_enterprise_server	*		Up to (excluding) 22.2.10
	运行在以下环境
	应用	nextcloud	nextcloud_enterprise_server	*	From (including) 23.0.0	Up to (excluding) 23.0.7
	运行在以下环境
	应用	nextcloud	nextcloud_enterprise_server	*	From (including) 24.0.0	Up to (excluding) 24.0.3
	运行在以下环境
	应用	nextcloud	nextcloud_server	*		Up to (excluding) 22.2.10
	运行在以下环境
	应用	nextcloud	nextcloud_server	*	From (including) 23.0.0	Up to (excluding) 23.0.7
	运行在以下环境
	应用	nextcloud	nextcloud_server	*	From (including) 24.0.0	Up to (excluding) 24.0.3
	运行在以下环境
	系统	fedora_35	nextcloud	*		Up to (excluding) 25.0.1-1.fc35
	运行在以下环境
	系统	fedora_36	nextcloud	*		Up to (excluding) 25.0.1-1.fc36
	运行在以下环境
	系统	fedora_37	nextcloud	*		Up to (excluding) 25.0.1-1.fc37
	运行在以下环境
	系统	opensuse_Leap_15.4	nextcloud	*		Up to (excluding) 23.0.12-bp154.2.3.1

攻击路径

本地
攻击复杂度

困难
权限要求

普通权限
影响范围

有限影响
EXP成熟度

未验证
补丁情况

官方补丁
数据保密性

无影响
数据完整性

无影响
服务器危害

无影响
全网数量

N/A

CWE-ID	漏洞类型
CWE-20	输入验证不恰当
CWE-400	未加控制的资源消耗（资源穷尽）

中危 nextcloud nextcloud_enterprise_server 输入验证不恰当

漏洞描述

解决建议

参考链接

受影响软件情况