Resource exhaustion in Nextcloud Enterprise Server
CVE-2022-39346
Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.010 (58.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L.
Affected products
- Nextcloud Nextcloud_enterprise_server
- Nextcloud Nextcloud_server
- Nextcloud Security-advisories — versions < 22.2.10, >= 23.0.0, < 23.0.7, >= 24.0.0, < 24.0.3
- Fedoraproject Fedora — versions 35, 36, 37
Weakness classification (CWE)
References
- security-advisories@github.com (Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory)
- security-advisories@github.com (Permissions Required, Third Party Advisory)
- security-advisories@github.com (vendor-advisory)
- security-advisories@github.com (vendor-advisory)
- security-advisories@github.com (vendor-advisory)
Frequently asked questions
- What is CVE-2022-39346?
- CVE-2022-39346 is a low-severity vulnerability in Nextcloud Enterprise Server, classified under Improper Input Validation. CVSS score: 3.5/10. Published 2022-11-25.
- How severe is CVE-2022-39346?
- Low severity. CVSS v3 base score is 3.5 out of 10.