Lucene search

[email protected]CVE-2022-39346

HistoryNov 25, 2022 - 7:15 p.m.

CVE-2022-39346

2022-11-2519:15:11

CWE-400

CWE-20

[email protected]

web.nvd.nist.gov

nextcloud

server

cve-2022-39346

denial of service

upgrade

database overload

nvd

security vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.3

Confidence

High

EPSS

0.004

Percentile

74.4%

JSON

Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.

Affected configurations

Vulners

NVD

Node

nextcloudnotesRange<22.2.10nextcloud

nextcloudnotesRange23.0.0–23.0.7nextcloud

nextcloudnotesRange24.0.0–24.0.3nextcloud

VendorProductVersionCPE
nextcloudnextcloud*cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*
nextcloudnextcloud*cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*
nextcloudnextcloud*cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nextcloud	nextcloud	*	cpe:2.3:a:nextcloud:nextcloud::::::::
nextcloud	nextcloud	*	cpe:2.3:a:nextcloud:nextcloud::::::::
nextcloud	nextcloud	*	cpe:2.3:a:nextcloud:nextcloud::::::::

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": "< 22.2.10",
        "status": "affected"
      },
      {
        "version": ">= 23.0.0, < 23.0.7",
        "status": "affected"
      },
      {
        "version": ">= 24.0.0, < 24.0.3",
        "status": "affected"
      }
    ]
  }
]