CVE-2022-29243CWE-20CWE-400

Improper input-size validation on the user new session name in Nextcloud Server

Medium · published May 31, 2022

CVSS v3.1
4.3
EPSS
2%
Percentile
75.1
In the wild
Unconfirmed
What it is

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01565 · 75.1th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-400 · Uncontrolled Resource Consumption
Published
2022-05-31T16:15Z
EPSS history
Timeline
  • 31 MAY 16:15Z
    Improper input-size validation on the user new session name in Nextcloud Server
    cvelistv5