CVE-2022-31119CWE-532

Password disclosure in log file in Nextcloud Mail App

Low · published August 4, 2022

CVSS v3.1
3.1
EPSS
1%
Percentile
57.2
In the wild
Unconfirmed
What it is

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to the logs complete access to affected accounts would be obtainable. It is recommended that the Nextcloud Mail is upgraded to 1.12.1. Operators should inspect their logs and remove passwords which have been logged. There are no workarounds to prevent logging in the event of a misconfiguration.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00833 · 57.2th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2022-08-04T17:15Z
EPSS history
Timeline
  • 04 AUG 17:15Z
    Password disclosure in log file in Nextcloud Mail App
    cvelistv5