CVE-2022-29243: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size…

PriorityP421medium4.3CVSS 3.1

AVNACLPRLUINSUCNINAL

EPSS

1.43%

69.7th percentile

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
nextcloud	nextcloud_server	< 22.2.7	22.2.7
nextcloud	nextcloud_server	< 23.0.4	23.0.4
nextcloud	security-advisories	< 22.2.7	22.2.7
nextcloud	security-advisories	—	—

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.