Skip to content
Heist/ feed
Back to feed
Low

Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails

Type: advisorySources: OSV

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known workarounds are available.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2023-25161
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 23:27 UTC · Revision 1

Source evidence

Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails

core-osv · Original source

Published 13 Feb 2023, 20:22 UTC

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known workarounds are available.

osv:CVE-2023-25161
Complete source record
{
  "id": "c724041f4347d4997725b71b4fb6fe34264051afabe7dc75497172b8b60e5251",
  "url": "https://osv.dev/vulnerability/CVE-2023-25161",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails",
    "summary": "Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known workarounds are available.",
    "evidence": "osv:CVE-2023-25161",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2023-25161",
      "aliases": [
        "CVE-2023-25161",
        "GHSA-492h-596q-xr2f"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nextcloud/server",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4eca7512330808a958cbf00bbd9044ea77b3ab6b"
                },
                {
                  "introduced": "5f37aacb3194d51503aaa3529ae8f676b32a25d7"
                },
                {
                  "fixed": "888ffa498d3a08bb32591704806ee90075b4bc20"
                },
                {
                  "introduced": "20ea9a25353129b56d46951fe7d23939665ab2b2"
                },
                {
                  "last_affected": "20ea9a25353129b56d46951fe7d23939665ab2b2"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "23.0.12"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "24.0.0"
                      },
                      {
                        "fixed": "24.0.8"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:nextcloud:nextcloud_server:25.0.0:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "25.0.0"
                      },
                      {
                        "last_affected": "25.0.0"
                      }
                    ],
                    "source": "CPE_STRING"
                  }
                ]
              }
            }
          ],
          "versions": [
            "25.0.0",
            "= 25.0.0",
            "v23.0.12rc2",
            "v24.0.8rc2",
            "v23.0.12rc1",
            "v24.0.8rc1",
            "v23.0.11",
            "v24.0.7",
            "v24.0.7rc1",
            "v23.0.11rc1",
            "v25.0.0",
            "v23.0.10",
            "v24.0.6",
            "v23.0.10rc1",
            "v24.0.6rc1",
            "v23.0.9",
            "v24.0.5",
            "v23.0.9rc1",
            "v24.0.5rc1",
            "v23.0.8",
            "v24.0.4",
            "v23.0.8rc1",
            "v24.0.4rc1",
            "v23.0.7",
            "v24.0.3",
            "v23.0.7rc2",
            "v24.0.3rc2",
            "v23.0.7rc1",
            "v24.0.3rc1",
            "v23.0.6",
            "v24.0.2",
            "v23.0.6rc1",
            "v24.0.2rc1",
            "v23.0.5",
            "v24.0.1",
            "v23.0.5rc1",
            "v24.0.1rc1",
            "v24.0.0",
            "v23.0.4",
            "v23.0.4rc1",
            "v23.0.3",
            "v23.0.3rc2",
            "v23.0.3rc1",
            "v23.0.2",
            "v23.0.2rc1",
            "v23.0.1",
            "v23.0.1rc3",
            "v23.0.1rc2",
            "v23.0.1rc1",
            "v23.0.0",
            "v23.0.0rc3",
            "v23.0.0rc2",
            "v23.0.0rc1",
            "v23.0.0beta3",
            "v23.0.0beta2",
            "v23.0.0beta1",
            "v22.0.0rc1",
            "v22.0.0beta5",
            "v22.0.0beta4",
            "v22.0.0beta2",
            "v22.0.0beta1",
            "v21.0.0beta8",
            "v21.0.0beta7",
            "v21.0.0beta6",
            "v21.0.0beta5",
            "v21.0.0beta4",
            "v21.0.0beta3",
            "v21.0.0beta2",
            "v21.0.0beta1",
            "v20.0.0RC1",
            "v20.0.0beta4",
            "v20.0.0beta3",
            "v20.0.0beta2",
            "v20.0.0beta1",
            "v19.0.0RC2",
            "v19.0.0RC1",
            "v19.0.0beta7",
            "v19.0.0beta6",
            "v19.0.0beta5",
            "v19.0.0beta4",
            "v19.0.0beta3",
            "v19.0.0beta2",
            "v19.0.0beta1",
            "v18.0.0RC1",
            "v18.0.0beta4",
            "v18.0.0beta3",
            "v18.0.0beta2",
            "v18.0.0beta1",
            "v17.0.0beta4",
            "v17.0.0beta3",
            "v17.0.0beta2",
            "v17.0.0beta1",
            "v16.0.0RC1",
            "v16.0.0beta3",
            "v16.0.0beta2",
            "v16.0.0beta1",
            "v16.0.0alpha1",
            "v15.0.0RC1",
            "v15.0.0beta2",
            "v15.0.0beta1",
            "v14.0.0RC2",
            "v14.0.0RC1",
            "v14.0.0beta4",
            "v14.0.0beta3",
            "v14.0.0beta2",
            "v14.0.0beta1",
            "v13.0.0RC1",
            "v13.0.0beta4",
            "v13.0.0beta3",
            "v13.0.0beta2",
            "v13.0.0beta1",
            "v12.0.0beta4",
            "v12.0.0beta3",
            "v12.0.0beta2",
            "v12.0.0beta1",
            "v11.0.0",
            "v11.0RC2",
            "v9.1.0beta1",
            "v9.0.0beta2",
            "v9.0beta1",
            "v8.2RC1",
            "v8.2beta1",
            "v8.1RC2",
            "v8.1.0beta2",
            "v8.1.0beta1",
            "v8.1.0alpha2",
            "v8.1.0alpha1",
            "v8.0.0",
            "v8.0.0RC2",
            "v8.0.0RC1",
            "v8.0.0beta2",
            "v8.0.0beta1",
            "v8.0.0alpha2",
            "v8.0.0alpha1",
            "v7.0.0beta1",
            "v7.0.0alpha2",
            "v6.0.0RC2",
            "v6.0.0RC1",
            "v6.0.0beta5",
            "v6.0.0beta4",
            "v6.0.0beta3",
            "v6.0.0beta2",
            "v6.0.0alpha2",
            "v5.0.0",
            "v5.0.0RC3",
            "v5.0.0RC2",
            "v5.0.0RC1",
            "v5.0.0beta2",
            "v5.0.0beta1",
            "v5.0.0alpha1",
            "v4.5.0",
            "v4.5.0RC3",
            "v4.5.0RC2",
            "v4.5.0RC1",
            "v4.5.0beta4",
            "v4.5.0beta3",
            "v4.0.6",
            "v4.0.5",
            "v4.0.4",
            "v4.0.1",
            "v4.0.0",
            "v4.0.0RC2",
            "v4.0.0RC",
            "v4.0.0beta",
            "v3.0",
            "v1.0.0beta1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25161.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:40.343238074Z",
      "provider": "osv",
      "references": [
        "https://hackerone.com/reports/1691195",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25161.json",
        "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-596q-xr2f",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-25161",
        "https://github.com/nextcloud/server/pull/34632"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-284"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25161.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-25161",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 507978,
  "published_at": "2023-02-13T20:22:32.743+00:00"
}