CVE-2022-31118CWE-770

Missing brute force protection on cloud federation sharing in Nextcloud Server

Medium · published August 4, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
55.1
In the wild
Unconfirmed
What it is

Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00767 · 55.1th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2022-08-04T16:50Z
EPSS history
Timeline
  • 04 AUG 16:50Z
    Missing brute force protection on cloud federation sharing in Nextcloud Server
    cvelistv5