CVE-2022-29243

Katalog CVE

CVSS 4.3 · Medium EPSS 1,5%

Kerentanan Improper Input Validation pada nextcloud server. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.

Rincian

Terbit di NVD

31 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/server/pull/31658 patch · advisory pihak ketiga
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5w advisory pihak ketiga
• https://hackerone.com/reports/1153138 advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-17 advisory pihak ketiga