CVE-2022-29243
Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names.
Does this matter?
Lower severity and a low EPSS score (1.50%). Track it; it rarely justifies an emergency change on its own.
Description
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 1.50% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20, CWE-400
- Affected
- nextcloud/nextcloud server
- Source
- security-advisories@github.com
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5wThird Party Advisory
- https://github.com/nextcloud/server/pull/31658Patch, Third Party Advisory
- https://hackerone.com/reports/1153138Third Party Advisory
- https://security.gentoo.org/glsa/202208-17Third Party Advisory
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5wThird Party Advisory
- https://github.com/nextcloud/server/pull/31658Patch, Third Party Advisory
- https://hackerone.com/reports/1153138Third Party Advisory
- https://security.gentoo.org/glsa/202208-17Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.