Vulnerability · Published Sep 6, 2022 · Assigned by GitHub_M

CVE-2022-35931Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator

Low 2.7

In plain English

A low-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.5%top 59.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>= 24.0.0, < 24.0.3< 22.2.10>= 23.0.0, < 23.0.7

Weakness: CWE-261 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7mw-9q4r-8qwr x_refsource_CONFIRM
https://github.com/nextcloud/password_policy/pull/363 x_refsource_MISC