CVE-2020-8202 Denial of service in Nextcloud Preferred Providers
An attacker can cause a denial of service in Nextcloud Preferred Providers by submitting a very long password due to improper input checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8202?
CVE-2020-8202 is a medium-severity denial of service vulnerability in Nextcloud Preferred Providers, published on 30 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when using a very long password.
Weakness: CWE-307
Which versions are affected by CVE-2020-8202?
It affects 1 product.
Products include Nextcloud Preferred Providers.
How do I fix CVE-2020-8202?
No fix has been published for CVE-2020-8202 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-8202 being exploited?
There is no known exploitation of CVE-2020-8202 in the wild and no public exploit code.
Other vulnerabilities in Nextcloud Preferred Providers
Sources
Also known as GHSA-5qmp-36gw-8g5g.