CVE-2022-31118

Katalog CVE

CVSS 5.3 · Medium EPSS 0,75%

Kerentanan Allocation of Resources Without Limits or Throttling pada nextcloud server. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.

Rincian

Terbit di NVD

4 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling
CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/server/pull/32843/commits/6eb692da7fe73c899cb6a8d2aa045eddb1f14018 patch · advisory pihak ketiga
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vwh-5v93-3vcq advisory pihak ketiga