PT-2022-26192 · Nextcloud+1 · Nextcloud Server+1

Not_Hackeronefour · Published 2022-10-28 · Updated 2023-01-16 · CVE-2022-41969

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 23.0.11 Nextcloud Server versions prior to 24.0.7 Nextcloud Server versions prior to 25.0.0

Description The issue affects Nextcloud Server, an open source personal cloud server, where prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. This allows an administrator to cause a limited Denial of Service (DoS) attack against their own server.

Recommendations For versions prior to 23.0.11, update to version 23.0.11 or later to resolve the issue. For versions prior to 24.0.7, update to version 24.0.7 or later to resolve the issue. For versions prior to 25.0.0, update to version 25.0.0 or later to resolve the issue. As a temporary workaround, do not create user accounts with long passwords.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-521

Related Identifiers

ALT-PU-2022-2949

ALT-PU-2023-1056

CVE-2022-41969

GHSA-4GM7-J7WG-M4FX

Affected Products

Alt Linux

Nextcloud Server

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41969.json · Exploit
• https://github.com/nextcloud/server/pull/34500 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41969 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41969 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gm7-j7wg-m4fx · Note
• https://t.me/cvenotify/38915 · Telegram Post
• https://hackerone.com/reports/1727424 · Note