CVE-2023-32319 Basic auth header on WebDAV requests is not brute-force protected in Nextcloud

High 8.1 Published 26 May 2023 Updated 14 Jan 2025

Attackers can brute-force user credentials on WebDAV endpoints due to missing rate limiting, leading to account takeover.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-32319?

CVE-2023-32319 is a high-severity authentication bypass vulnerability in Nextcloud Nextcloud Server, published on 26 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issue has been addressed in releases 24.0.11, 25.0.5 and 26.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-307

Which versions are affected by CVE-2023-32319?

It affects 1 product.

Products include Nextcloud Nextcloud Server.

How do I fix CVE-2023-32319?

No fix has been published for CVE-2023-32319 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-32319 being exploited?

There is no known exploitation of CVE-2023-32319 in the wild and no public exploit code.

All Nextcloud Nextcloud Server vulnerabilities

Sources

Also known as GHSA-mr7q-xf62-fw54.