CVE-2022-41968 - Nextcloud Server's calendar name length not validated before writing to database

Back Back to CVE browser

MEDIUM

Nextcloud Server's calendar name length not validated before writing to database

Published Dec 1, 2022

5.3

MEDIUM

CVSS 3.1

EPSS 0.92%

Description

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available.

Affected products

Vendor Nextcloud Product Security-Advisories Default
n/a
- Version
  < 23.0.10
  Status
  affected
  Constraints
  -
- Version
  >= 24.0.0, < 24.0.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nextcloud

Security-Advisories

n/a

Version	Status	Constraints
< 23.0.10	affected	-
>= 24.0.0, < 24.0.5	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1284

CWE-400

Uncontrolled Resource Consumption

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45072
Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m92j-xxc8-hq3v
x_refsource_CONFIRMThird Party Advisory
https://github.com/nextcloud/server/pull/33139
x_refsource_MISCPatchThird Party Advisory
https://hackerone.com/reports/1596148
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45072		Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m92j-xxc8-hq3v		x_refsource_CONFIRMThird Party Advisory
https://github.com/nextcloud/server/pull/33139		x_refsource_MISCPatchThird Party Advisory
https://hackerone.com/reports/1596148		x_refsource_MISCThird Party Advisory