CVE-2022-41968 : Nextcloud Server is an open source personal cloud server. Prior to versions 23.0

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available.

Published 2022-12-01 21:15:20

Updated 2023-07-06 13:42:25

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2022-41968

Nextcloud » Nextcloud Server » Enterprise Edition
Versions from including (>=) 23.0.0 and before (<) 23.0.10
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
Matching versions
Nextcloud » Nextcloud Server » Enterprise Edition
Versions from including (>=) 24.0.0 and before (<) 24.0.5
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
Matching versions
Nextcloud » Nextcloud Server
Versions from including (>=) 23.0.0 and before (<) 23.0.10
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Matching versions
Nextcloud » Nextcloud Server
Versions from including (>=) 24.0.0 and before (<) 24.0.5
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-41968

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 23 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-41968

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low
3.5	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L	2.1	1.4	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: Low

CWE ids for CVE-2022-41968

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

Assigned by: security-advisories@github.com (Secondary)
CWE-1284 Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-41968

https://hackerone.com/reports/1596148

HackerOne
Third Party Advisory
https://github.com/nextcloud/server/pull/33139

Check calendar URI length before creation by miaulalala · Pull Request #33139 · nextcloud/server · GitHub
Patch;Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m92j-xxc8-hq3v

Calendar name length not validated before writing to database · Advisory · nextcloud/security-advisories · GitHub
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-41968

Products affected by CVE-2022-41968

Exploit prediction scoring system (EPSS) score for CVE-2022-41968

CVSS scores for CVE-2022-41968

CWE ids for CVE-2022-41968

References for CVE-2022-41968