CVE-2022-31118
CVSS V2 None
CVSS V3 Medium 5.3
Description
Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.
Overview
- CVE ID
- CVE-2022-31118
- Assigner
- security-advisories@github.com
- Vulnerability Status
- Analyzed
- Published Version
- 2022-08-04T17:15:08
- Last Modified Date
- 2022-08-10T15:31:24
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | 1 | OR | 22.2.9 | |
| cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | 1 | OR | 23.0.0 | 23.0.6 |
| cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | 1 | OR | 24.0.0 | 24.0.2 |
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- LOW
- Availability Impact
- NONE
- Base Score
- 5.3
- Base Severity
- MEDIUM
- Exploitability Score
- 3.9
- Impact Score
- 1.4
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2022-31118 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31118 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-08-04 18:00:11 | Added to TrackCVE |