Vulnerability Name:

CVE-2020-8228 (CCN-189306)

Assigned:2020-08-03
Published:2020-08-03
Updated:2020-10-20
Summary:A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.
CVSS v3 Severity:5.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
4.6 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
3.1 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-307
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2020-8228

Source: SUSE
Type: Third Party Advisory
openSUSE-SU-2020:1652

Source: XF
Type: UNKNOWN
nextcloud-cve20208228-dos(189306)

Source: MISC
Type: Exploit, Third Party Advisory
https://hackerone.com/reports/922470

Source: CCN
Type: NC-SA-2020-033
Missing rate limit on signup page

Source: MISC
Type: Vendor Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-033

Vulnerable Configuration:Configuration 1:
  • cpe:/a:nextcloud:preferred_providers:1.7.0:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
  • OR cpe:/a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*
  • OR cpe:/o:opensuse:leap:15.1:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:leap:15.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20208228
    V
    		CVE-2020-8228
    2022-05-22
    oval:org.opensuse.security:def:64756
    P
    		Security update for gstreamer-plugins-good (Moderate)
    2021-09-02
    oval:org.opensuse.security:def:64556
    P
    		Security update for libsndfile (Critical)
    2021-08-17
    oval:org.opensuse.security:def:63133
    P
    		terraform-provider-helm-1.3.2-6.3.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63507
    P
    		php7-embed-7.4.6-3.17.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63369
    P
    		redis-6.0.10-1.7.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63101
    P
    		postgresql12-12.6-8.16.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:64512
    P
    		Security update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly (Important)
    2021-06-01
    oval:org.opensuse.security:def:64649
    P
    		Security update for qemu (Important)
    2021-02-19
    oval:org.opensuse.security:def:64648
    P
    		Security update for bind (Important)
    2021-02-18
    oval:org.opensuse.security:def:74622
    P
    		Security update for python3 (Important)
    2020-12-23
    oval:org.opensuse.security:def:64444
    P
    		Security update for curl (Moderate)
    2020-12-09
    oval:org.opensuse.security:def:63604
    P
    		MozillaThunderbird-68.8.0-3.80.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62711
    P
    		open-vm-tools-desktop-11.1.0-2.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63311
    P
    		xen-4.13.1_02-1.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63105
    P
    		python3-keystoneclient-3.15.0-2.33 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62687
    P
    		libnma-devel-1.8.24-5.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62688
    P
    		libopenjpeg1-1.5.2-2.28 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63167
    P
    		libvirglrenderer0-0.6.0-2.30 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63108
    P
    		aws-cli-1.16.61-6.22 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62888
    P
    		blktrace-1.1.0+git.20170126-3.3.28 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:25385
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25774
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:64300
    P
    		libXext-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64060
    P
    		Security update for dovecot22 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25328
    P
    		Security update for spice (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:74496
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:25760
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:63733
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25247
    P
    		Security update for libpng16 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:75103
    P
    		Security update for nextcloud (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25120
    P
    		Security update for openwsman (Important)
    2020-12-01
    oval:org.opensuse.security:def:74970
    P
    		Security update for libredwg (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25672
    P
    		Security update for java-1_7_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:64183
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26491
    P
    		Security update for nextcloud (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25056
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:65028
    P
    		Security update for shim (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64402
    P
    		libwavpack1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25619
    P
    		Security update for libmspack (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63954
    P
    		Security update for adns (Important)
    2020-12-01
    oval:org.opensuse.security:def:26456
    P
    		Security update for MozillaThunderbird (Important)
    2020-12-01
    oval:org.opensuse.security:def:64916
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25469
    P
    		Security update for ncurses (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:63807
    P
    		Security update for sysstat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25818
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:25045
    P
    		Security update for libcaca (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64858
    P
    		Security update for python (Important)
    2020-12-01
    oval:org.opensuse.security:def:64194
    P
    		haproxy on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:100245
    P
    		 (Moderate)
    2020-11-19
    oval:org.opensuse.security:def:96375
    P
    		Security update for nextcloud (Moderate)
    2020-10-10
    oval:org.opensuse.security:def:110798
    P
    		Security update for nextcloud (Moderate)
    2020-10-10
    oval:org.opensuse.security:def:109722
    P
    		Security update for nextcloud (Moderate)
    2020-10-10
    oval:org.opensuse.security:def:103065
    P
    		Security update for nextcloud (Moderate)
    2020-10-10
    oval:org.opensuse.security:def:93532
    P
    		Security update for nextcloud (Moderate)
    2020-10-10
    oval:org.opensuse.security:def:110246
    P
    		Security update for nextcloud (Moderate)
    2020-10-10
    BACK
    nextcloud preferred providers 1.7.0
    opensuse backports sle 15.0 sp1
    opensuse backports sle 15.0 sp2
    opensuse leap 15.1
    opensuse leap 15.2