VulnerabilityModified
CVE-2022-41969
Nextcloud Server is an open source personal cloud server.
LOW 2.7EPSS 0.84%
Does this matter?
Lower severity and a low EPSS score (0.84%). Track it; it rarely justifies an emergency change on its own.
Description
Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don't create user accounts with long passwords.
- CVSS 3.1
- 2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 0.84% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400, CWE-521
- Affected
- nextcloud/nextcloud server
- Source
- security-advisories@github.com
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gm7-j7wg-m4fxThird Party Advisory
- https://github.com/nextcloud/server/pull/34500Patch, Third Party Advisory
- https://hackerone.com/reports/1727424Permissions Required, Third Party Advisory
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gm7-j7wg-m4fxThird Party Advisory
- https://github.com/nextcloud/server/pull/34500Patch, Third Party Advisory
- https://hackerone.com/reports/1727424Permissions Required, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.