PT-2022-19492 · Nextcloud+1 · Nextcloud Server+1

Demonia · Published 2022-05-31 · Updated 2022-09-27 · CVE-2022-29243

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 22.2.7 Nextcloud Server versions prior to 23.0.4

Description The issue is related to missing input-size validation of new session names in Nextcloud Server, allowing users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance.

Recommendations For Nextcloud Server versions prior to 22.2.7, update to version 22.2.7 or later to resolve the issue. For Nextcloud Server versions prior to 23.0.4, update to version 23.0.4 or later to resolve the issue.

Exploit

Fix

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

ALT-PU-2022-2504

ALT-PU-2022-2555

CVE-2022-29243

GHSA-7CWM-QPH5-4H5W

Affected Products

Alt Linux

Nextcloud Server

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29243.json · Exploit
• https://github.com/nextcloud/server/pull/31658 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29243 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29243 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-17 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5w · Note
• https://hackerone.com/reports/1153138 · Note
• https://t.me/cibsecurity/43570 · Telegram Post
• https://t.me/cvenotify/30921 · Telegram Post