Vulnerability · Published Aug 4, 2022 · Assigned by GitHub_M

CVE-2022-31120Federated share accepting/declining is not logged in audit log in Nextcloud Server

Low 2.1

In plain English

A low-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)2.1Low

Exploit odds (30 days)0.9%top 40.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>= 23.0.0, < 23.0.4< 22.2.7

Weakness: CWE-778 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/31594/commits/1d8bf9a89c6856218802a1d365000a5831be8655 x_refsource_MISC
https://portal.nextcloud.com/article/using-the-audit-log-44.html x_refsource_MISC