Resource exhaustion in Nextcloud Enterprise Server
CVE-2022-39346
Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.011 (63.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 63.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.011 · change: +0.001
Affected products
- Nextcloud Enterprise Server
- Nextcloud Server
- Nextcloud Security-Advisories — versions < 22.2.10, >= 23.0.0, < 23.0.7, >= 24.0.0, < 24.0.3
- Fedoraproject Fedora — versions 35, 36, 37
Weakness classification (CWE)
References
- github.com/nextcloud/security-advisories/security/advisories/GHSA-6w9f-jgjx-4vj6 (Third Party Advisory)
- github.com/nextcloud/server/pull/33052 (Patch, Third Party Advisory)
- hackerone.com/reports/1588562 (Permissions Required, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2022-39346?
- CVE-2022-39346 is a low-severity vulnerability in Nextcloud Enterprise Server, classified under Improper Input Validation. CVSS score: 3.5/10. Published 2022-11-25.
- How severe is CVE-2022-39346?
- Low severity. CVSS v3 base score is 3.5 out of 10.