Vulnerability · Published Aug 4, 2022 · Assigned by GitHub_M

CVE-2022-31119Password disclosure in log file in Nextcloud Mail App

Low 3.1

In plain English

A low-severity sensitive data in logs in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.8%top 42.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to the logs complete access to affected accounts would be obtainable. It is recommended that the Nextcloud Mail is upgraded to 1.12.1. Operators should inspect their logs and remove passwords which have been logged. There are no workarounds to prevent logging in the event of a misconfiguration.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 1.12.1

Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-63m3-w68h-3wjg x_refsource_CONFIRM
https://github.com/nextcloud/mail/issues/823 x_refsource_MISC
https://github.com/nextcloud/mail/pull/6488/commits/ab9ade57fbc1f465ffe905248f93f328d638d7e5 x_refsource_MISC