CVE-2022-31119

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to the logs complete access to affected accounts would be obtainable. It is recommended that the Nextcloud Mail is upgraded to 1.12.1. Operators should inspect their logs and remove passwords which have been logged. There are no workarounds to prevent logging in the event of a misconfiguration.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Aug 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-31125.5An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks c CVE-2022-311202.7Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incomple CVE-2022-311217.5Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus re CVE-2022-311228.1Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Conf CVE-2022-311237.8Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in th CVE-2022-311246.5openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions CVE-2022-311259.8Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remo CVE-2022-311269.8Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remo CVE-2022-311276.1NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-ma CVE-2022-311285.4Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not CVE-2022-311297.5moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to u CVE-2022-31135.5An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.