CVE-2022-35931CWE-261

Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator

Low · published September 6, 2022

CVSS v3.1
2.7
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-261 · Weak Encoding for Password
Published
2022-09-06T18:10Z
EPSS history
Timeline
  • 06 SEP 18:10Z
    Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator
    cvelistv5