CVE-2022-41968: Nextcloud Server's calendar name length not validated before writing to database
Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-41968?
CVE-2022-41968 is a vulnerability in Nextcloud Server where calendar name lengths are not validated before writing to a database, allowing an attacker to send unnecessary amounts of data against the database.
How can an attacker exploit CVE-2022-41968?
An attacker can exploit CVE-2022-41968 by sending excessive amounts of data against the Nextcloud Server database.
What is the severity of CVE-2022-41968?
CVE-2022-41968 has a severity rating of 5.3 (medium).
Which versions of Nextcloud Server are affected by CVE-2022-41968?
Versions 23.0.0 to 23.0.10 and versions 24.0.0 to 24.0.5 of Nextcloud Server are affected by CVE-2022-41968.
How can I fix CVE-2022-41968?
To fix CVE-2022-41968, update Nextcloud Server to version 23.0.10 or 24.0.5, which contain patches for the vulnerability.