PT-2022-24916 · Nextcloud+1 · Nextcloud Server+1

Errorsec · Published 2022-08-26 · Updated 2023-04-03 · CVE-2022-39346

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 22.2.10 Nextcloud Server versions prior to 23.0.7 Nextcloud Server versions prior to 24.0.3

Description The Nextcloud server is an open source personal cloud server. Affected versions of the Nextcloud server did not properly limit user display names, which could allow malicious users to overload the backing database and cause a denial of service.

Recommendations For versions prior to 22.2.10, upgrade to 22.2.10. For versions prior to 23.0.7, upgrade to 23.0.7. For versions prior to 24.0.3, upgrade to 24.0.3.

Exploit

Fix

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

ALT-PU-2022-2504

ALT-PU-2022-2555

CVE-2022-39346

GHSA-6W9F-JGJX-4VJ6

OPENSUSE-SU-2023:0083-1

Affected Products

Alt Linux

Nextcloud Server

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39346.json · Exploit
• https://github.com/nextcloud/server/pull/33052 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39346 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TARDPRPBTI5TJRBYRVVQGTL6KWRCV5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39346 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRAER4DCCHHSUDFHQ6LTIH4JEJFF73IU · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R32L3P53AQKQQC652LA5U3AWFTZKPDK3 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0083-1 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6w9f-jgjx-4vj6 · Note
• https://bugzilla.suse.com/1205802 · Note
• https://hackerone.com/reports/1588562 · Note
• https://t.me/cvenotify/38497 · Telegram Post
• https://suse.com/security/cve/CVE-2022-35931 · Note
• https://t.me/cvenotify/39703 · Telegram Post
• https://suse.com/security/cve/CVE-2023-25579 · Note