CVE-2022-41968
published 2022-12-01CVE-2022-41968: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.85%
53.4th percentile
Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nextcloud | nextcloud_server | >= 23.0.0 < 23.0.10 | 23.0.10 |
| nextcloud | nextcloud_server | >= 24.0.0 < 24.0.5 | 24.0.5 |
| nextcloud | security-advisories | < 23.0.10 | 23.0.10 |
| nextcloud | security-advisories | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m92j-xxc8-hq3vhttps://github.com/nextcloud/server/pull/33139https://hackerone.com/reports/1596148https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m92j-xxc8-hq3vhttps://github.com/nextcloud/server/pull/33139https://hackerone.com/reports/1596148
2022-12-01
Published