Nextcloud Preferred Providers vulnerabilities

2 CVEs affecting Nextcloud Preferred Providers, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-8228, published 2020-10-05.

More from Nextcloud.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-8228, published 2020-10-05. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.
• CVE-2020-8202, published 2020-07-30. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when using a very long password.