PT-2022-23037 · Nextcloud · Nextcloud Password Policy

Lownickvergessen · Published 2022-09-06 · Updated 2023-04-03 · CVE-2022-35931

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Password Policy versions prior to 22.2.10 Nextcloud Password Policy versions prior to 23.0.7 Nextcloud Password Policy versions prior to 24.0.3

Description The random password generator in Nextcloud Password Policy may, in very rare cases, generate common passwords that the validator itself would block.

Recommendations Upgrade to version 22.2.10 to receive a patch for the issue in Password Policy. Upgrade to version 23.0.7 to receive a patch for the issue in Password Policy. Upgrade to version 24.0.3 to receive a patch for the issue in Password Policy.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-261

Related Identifiers

CVE-2022-35931

GHSA-C7MW-9Q4R-8QWR

OPENSUSE-SU-2023:0083-1

Affected Products

Nextcloud Password Policy

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35931.json · Exploit
• https://github.com/nextcloud/password_policy/pull/363 · Patch
• https://osv.dev/vulnerability/CVE-2022-35931 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35931 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2023:0083-1 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7mw-9q4r-8qwr · Note
• https://t.me/cibsecurity/49351 · Telegram Post
• https://bugzilla.suse.com/1205802 · Note
• https://suse.com/security/cve/CVE-2022-35931 · Note
• https://suse.com/security/cve/CVE-2022-39346 · Note
• https://suse.com/security/cve/CVE-2023-25579 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/M7E2FX5KGET4IYNWVYBLR7XYJMJ7SJD4 · Note
• https://bugzilla.suse.com/1203190 · Note
• https://bugzilla.suse.com/1208591 · Note