CVE-2022-24741

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8 , 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the `'enable_previews'` config flag.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 21.0.8; >= 22.0.0, < 22.2.4; >= 23.0.0, < 23.0.1

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf3h-xf4q-mh89Third Party Advisory
https://github.com/nextcloud/server/pull/30291Patch, Third Party Advisory
https://hackerone.com/reports/1261225Exploit, Third Party Advisory
https://security.gentoo.org/glsa/202208-17Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf3h-xf4q-mh89Third Party Advisory
https://github.com/nextcloud/server/pull/30291Patch, Third Party Advisory
https://hackerone.com/reports/1261225Exploit, Third Party Advisory
https://security.gentoo.org/glsa/202208-17Third Party Advisory

Timeline

Published: Mar 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247425.5Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab CVE-2022-247438.2Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the pa CVE-2022-247443.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user session CVE-2022-247456.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessio CVE-2022-247466.1Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possib CVE-2022-247475.3Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do CVE-2022-247487.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it i CVE-2022-247496.1Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containi CVE-2022-24758.8Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any use CVE-2022-247507.8UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM p CVE-2022-247517.4Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition CVE-2022-247529.8SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end