CVE-2022-41968CWE-400

Nextcloud Server's calendar name length not validated before writing to database

Low · published December 1, 2022

CVSS v3.1
3.5
EPSS
1%
Percentile
59.9
In the wild
Unconfirmed
What it is

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00918 · 59.9th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2022-12-01T20:38Z
EPSS history
Timeline
  • 01 DEC 20:38Z
    Nextcloud Server's calendar name length not validated before writing to database
    cvelistv5