Vulnerability · Published Dec 1, 2022 · Assigned by GitHub_M
CVE-2022-41968Nextcloud Server's calendar name length not validated before writing to database
Low 3.5
In plain English
A low-severity uncontrolled resource consumption in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)1.0%top 38.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | < 23.0.10>= 24.0.0, < 24.0.5 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m92j-xxc8-hq3v x_refsource_CONFIRM
- https://github.com/nextcloud/server/pull/33139 x_refsource_MISC
- https://hackerone.com/reports/1596148 x_refsource_MISC