CVE-2022-41969: Nextcloud Server has no password length limit when creating a user as an administrator
Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don't create user accounts with long passwords.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-41969?
CVE-2022-41969 is a vulnerability in Nextcloud Server that allows an administrator to cause a limited Denial of Service (DoS) attack against their own server by creating a user with no password length limit.
How can an attacker exploit CVE-2022-41969?
An attacker can exploit CVE-2022-41969 by creating a user with a very long password, which can lead to a limited DoS attack against the Nextcloud Server.
What is the severity of CVE-2022-41969?
CVE-2022-41969 has a severity rating of low with a score of 2.7.
Which versions of Nextcloud Server are affected by CVE-2022-41969?
Versions 23.0.0 to 23.0.11 and versions 24.0.0 to 24.0.7 of Nextcloud Server are affected by CVE-2022-41969.
How can CVE-2022-41969 be fixed?
To fix CVE-2022-41969, it is recommended to upgrade Nextcloud Server to version 23.0.11, 24.0.7, or 25.0.0 or later, as these versions contain the necessary fix.