What is the vulnerability ID of this Nextcloud server vulnerability?

The vulnerability ID of this Nextcloud server vulnerability is CVE-2022-31120.

What is the impact of the vulnerability?

The vulnerability allows brute force attacks to go unnoticed due to incomplete logging of federated share events.

What are the affected versions of Nextcloud server?

The affected versions of Nextcloud server are up to version 22.2.7 and version 23.0.0 to 23.0.4.

How can the vulnerability be exploited?

The vulnerability can be exploited through brute force attacks on federated share events.

What is the severity of the vulnerability?

The severity of the vulnerability is low with a severity value of 2.7.

How can I fix the vulnerability?

To fix the vulnerability, upgrade to a version of Nextcloud server that is not affected by the vulnerability.

Where can I find more information about the vulnerability?

You can find more information about the vulnerability in the references provided: [Reference 1](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x), [Reference 2](https://github.com/nextcloud/server/pull/31594/commits/1d8bf9a89c6856218802a1d365000a5831be8655), [Reference 3](https://portal.nextcloud.com/article/using-the-audit-log-44.html).

Vulnerability/
CVE-2022-31120

low

2.7

CWE

778

4/8/2022

3/8/2024

CVE-2022-31120: Federated share accepting/declining is not logged in audit log in Nextcloud Server

First published: Thu Aug 04 2022(Updated: )

Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Nextcloud Nextcloud Server	<22.2.7
Nextcloud Nextcloud Server	>=23.0.0<23.0.4

Remedy

https://github.com/nextcloud/server/pull/31594/commits/1d8bf9a89c6856218802a1d365000a5831be8655

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the vulnerability ID of this Nextcloud server vulnerability?
The vulnerability ID of this Nextcloud server vulnerability is CVE-2022-31120.
What is Nextcloud server?
Nextcloud server is an open source personal cloud solution.
What is the impact of the vulnerability?
The vulnerability allows brute force attacks to go unnoticed due to incomplete logging of federated share events.
What are the affected versions of Nextcloud server?
The affected versions of Nextcloud server are up to version 22.2.7 and version 23.0.0 to 23.0.4.
How can the vulnerability be exploited?
The vulnerability can be exploited through brute force attacks on federated share events.
What is the severity of the vulnerability?
The severity of the vulnerability is low with a severity value of 2.7.
How can I fix the vulnerability?
To fix the vulnerability, upgrade to a version of Nextcloud server that is not affected by the vulnerability.
Where can I find more information about the vulnerability?
You can find more information about the vulnerability in the references provided: [Reference 1](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x), [Reference 2](https://github.com/nextcloud/server/pull/31594/commits/1d8bf9a89c6856218802a1d365000a5831be8655), [Reference 3](https://portal.nextcloud.com/article/using-the-audit-log-44.html).

collector/nvd-index
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/title
agent/author
agent/last-modified-date
agent/weakness
agent/severity
agent/remedy
agent/references
agent/tags
agent/description
agent/first-publish-date
agent/event
vendor/nextcloud
canonical/nextcloud nextcloud server
version/nextcloud nextcloud server/23.0.0