CVE-2022-31120

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-778

Affected software

No affected versions have been published.

Timeline

Published: Aug 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-311217.5Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus re CVE-2022-311228.1Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Conf CVE-2022-311237.8Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in th CVE-2022-311246.5openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions CVE-2022-311259.8Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remo CVE-2022-311269.8Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remo CVE-2022-311276.1NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-ma CVE-2022-311285.4Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not CVE-2022-311297.5moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to u CVE-2022-31135.5An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.CVE-2022-311307.5Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could l CVE-2022-311314.3Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user