CVE-2022-39346CWE-20CWE-400

Missing length validation of user displayname in nextcloud server

Low · published November 25, 2022

CVSS v3.1
3.5
EPSS
1%
Percentile
64.7
In the wild
Unconfirmed
What it is

Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01075 · 64.7th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-400 · Uncontrolled Resource Consumption
Published
2022-11-25T00:00Z
EPSS history
Timeline
  • 25 NOV 00:00Z
    Missing length validation of user displayname in nextcloud server
    cvelistv5