CVE-2022-41969CWE-400

Nextcloud Server has no password length limit when creating a user as an administrator

Low · published December 1, 2022

CVSS v3.1
2.4
EPSS
1%
Percentile
58.5
In the wild
Unconfirmed
What it is

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don't create user accounts with long passwords.

The record
Technical detail
CVSS v3.1
2.4 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00874 · 58.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2022-12-01T20:47Z
EPSS history
Timeline
  • 01 DEC 20:47Z
    Nextcloud Server has no password length limit when creating a user as an administrator
    cvelistv5