What is CVE-2022-31120?

CVE-2022-31120 is a low-severity vulnerability in Nextcloud Server, classified under CWE-778. CVSS score: 2.1/10. Published 2022-08-04.

How severe is CVE-2022-31120?

Low severity. CVSS v3 base score is 2.1 out of 10.

Vulnerability in Nextcloud Server

CVE-2022-31120

Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.

Published 2022-08-04 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 2.1 (Low). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.009 (57.4th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 57th percentile — 57.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: +0.000

Affected products

Nextcloud Server
Nextcloud Security-Advisories — versions >= 23.0.0, < 23.0.4, < 22.2.7

Weakness classification (CWE)

CWE-778

References

github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x (Third Party Advisory)
github.com/nextcloud/server/pull/31594/commits/1d8bf9a89c6856218802a1d365000a58… (Patch, Third Party Advisory)
portal.nextcloud.com/article/using-the-audit-log-44.html (Vendor Advisory)

Frequently asked questions

What is CVE-2022-31120?: CVE-2022-31120 is a low-severity vulnerability in Nextcloud Server, classified under CWE-778. CVSS score: 2.1/10. Published 2022-08-04.
How severe is CVE-2022-31120?: Low severity. CVSS v3 base score is 2.1 out of 10.