CVE-2022-29243
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.
- Affected products
- Alt Linux, Nextcloud Server
- Nextcloud Nextcloud Server
- < 22.2.7, 23.0.4
- Fix
- Available
- CVSS 3.1
- 4.3 MEDIUM
- EPSS
- 1.5% (71th percentile)
- Weakness
- CWE-400, CWE-20
- NVD status
- Modified
- Published
- 2022-05-31
CVE-2022-29243 at NVD
No indexed exploits for CVE-2022-29243 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2022-29243 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.