CVE-2022-31119

Katalog CVE

CVSS 4.9 · Medium EPSS 0,81%

Kerentanan Insertion of Sensitive Information into Log File pada nextcloud mail. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to the logs complete access to affected accounts would be obtainable. It is recommended that the Nextcloud Mail is upgraded to 1.12.1. Operators should inspect their logs and remove passwords which have been logged. There are no workarounds to prevent logging in the event of a misconfiguration.

Rincian

Terbit di NVD

4 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/mail/pull/6488/commits/ab9ade57fbc1f465ffe905248f93f328d638d7e5 patch · advisory pihak ketiga
• https://github.com/nextcloud/mail/issues/823 advisory pihak ketiga
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-63m3-w68h-3wjg advisory pihak ketiga