What is CVE-2022-31118?

CVE-2022-31118 is a vulnerability in the Nextcloud Server that allows an attacker to brute force access tokens for federated shares.

What is the severity of CVE-2022-31118?

CVE-2022-31118 has a severity rating of 5.3, which is considered medium.

How can an attacker exploit CVE-2022-31118?

An attacker can exploit CVE-2022-31118 by brute forcing access tokens for federated shares in the Nextcloud Server.

What versions of Nextcloud Server are affected by CVE-2022-31118?

Nextcloud Server versions up to 22.2.9 are affected, as well as versions between 23.0.0 and 23.0.6, and versions between 24.0.0 and 24.0.2.

How can I fix CVE-2022-31118?

To fix CVE-2022-31118, it is recommended to upgrade to a version of Nextcloud Server that is not affected. References to the specific versions can be found in the provided links.

Vulnerability/
CVE-2022-31118

medium

6.5

CWE

307 770

4/8/2022

3/8/2024

CVE-2022-31118: Missing brute force protection on cloud federation sharing in Nextcloud Server

First published: Thu Aug 04 2022(Updated: )

Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Nextcloud Nextcloud Server	<22.2.9
Nextcloud Nextcloud Server	>=23.0.0<23.0.6
Nextcloud Nextcloud Server	>=24.0.0<24.0.2

Remedy

https://github.com/nextcloud/server/pull/32843/commits/6eb692da7fe73c899cb6a8d2aa045eddb1f14018

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2022-31118?
CVE-2022-31118 is a vulnerability in the Nextcloud Server that allows an attacker to brute force access tokens for federated shares.
What is the severity of CVE-2022-31118?
CVE-2022-31118 has a severity rating of 5.3, which is considered medium.
How can an attacker exploit CVE-2022-31118?
An attacker can exploit CVE-2022-31118 by brute forcing access tokens for federated shares in the Nextcloud Server.
What versions of Nextcloud Server are affected by CVE-2022-31118?
Nextcloud Server versions up to 22.2.9 are affected, as well as versions between 23.0.0 and 23.0.6, and versions between 24.0.0 and 24.0.2.
How can I fix CVE-2022-31118?
To fix CVE-2022-31118, it is recommended to upgrade to a version of Nextcloud Server that is not affected. References to the specific versions can be found in the provided links.

collector/nvd-index
agent/references
agent/weakness
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/severity
agent/last-modified-date
agent/author
agent/remedy
agent/title
agent/first-publish-date
agent/tags
agent/description
agent/event
vendor/nextcloud
canonical/nextcloud nextcloud server
version/nextcloud nextcloud server/23.0.0
version/nextcloud nextcloud server/24.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.