CVE-2022-31120
First published: Thu Aug 04 2022(Updated: )
Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Nextcloud Server | <22.2.7 | |
| Nextcloud Nextcloud Server | >=23.0.0<23.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this Nextcloud server vulnerability?
The vulnerability ID of this Nextcloud server vulnerability is CVE-2022-31120.
What is Nextcloud server?
Nextcloud server is an open source personal cloud solution.
What is the impact of the vulnerability?
The vulnerability allows brute force attacks to go unnoticed due to incomplete logging of federated share events.
What are the affected versions of Nextcloud server?
The affected versions of Nextcloud server are up to version 22.2.7 and version 23.0.0 to 23.0.4.
How can the vulnerability be exploited?
The vulnerability can be exploited through brute force attacks on federated share events.
What is the severity of the vulnerability?
The severity of the vulnerability is low with a severity value of 2.7.
How can I fix the vulnerability?
To fix the vulnerability, upgrade to a version of Nextcloud server that is not affected by the vulnerability.
Where can I find more information about the vulnerability?
You can find more information about the vulnerability in the references provided: [Reference 1](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x), [Reference 2](https://github.com/nextcloud/server/pull/31594/commits/1d8bf9a89c6856218802a1d365000a5831be8655), [Reference 3](https://portal.nextcloud.com/article/using-the-audit-log-44.html).
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/event
- vendor/nextcloud
- canonical/nextcloud nextcloud server
- version/nextcloud nextcloud server/23.0.0