Lucene search

GitHub_MCVE-2022-39330

HistoryOct 27, 2022 - 2:15 p.m.

CVE-2022-39330

2022-10-2714:15:12

CWE-400

GitHub_M

web.nvd.nist.gov

nextcloud

nextcloud server

enterprise server

cve-2022-39330

vulnerability

database load

cpu load

circles app

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

39.7%

JSON

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by generating a lot of database/cpu load. Nextcloud Server versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server versions 22.2.10, 23.0.10, and 24.0.6 contain patches for this issue. As a workaround, disable the Circles app.

Affected configurations

Nvd

Vulners

Node

nextcloudnextcloud_enterprise_serverRange<22.2.10

nextcloudnextcloud_enterprise_serverRange23.0.0–23.0.10

nextcloudnextcloud_enterprise_serverRange24.0.0–24.0.6

nextcloudnextcloud_serverRange<23.0.10

nextcloudnextcloud_serverRange24.0.0–24.0.6

VendorProductVersionCPE
nextcloudnextcloud_enterprise_server*cpe:2.3:a:nextcloud:nextcloud_enterprise_server:*:*:*:*:*:*:*:*
nextcloudnextcloud_server*cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nextcloud	nextcloud_enterprise_server	*	cpe:2.3:a:nextcloud:nextcloud_enterprise_server::::::::
nextcloud	nextcloud_server	*	cpe:2.3:a:nextcloud:nextcloud_server::::::::

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": ">= 23.0.0, < 23.0.9",
        "status": "affected"
      },
      {
        "version": ">= 24.0.0, < 24.0.5",
        "status": "affected"
      },
      {
        "version": "< 22.2.10",
        "status": "affected"
      }
    ]
  }
]