CVE-2022-39346

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-400

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 22.2.10; >= 23.0.0, < 23.0.7; >= 24.0.0, < 24.0.3

References

Timeline

Published: Nov 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-393475.7FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path CVE-2022-393485.4Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured CVE-2022-393495.5The Tasks.org Android app is an open-source app for to-do lists and reminders. The Tasks.org app uses the activity `ShareLinkActivity.kt` to CVE-2022-39355.4The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users CVE-2022-393505.4@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allow CVE-2022-393514.4Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior CVE-2022-393529.8OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authori CVE-2022-393539.8xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not CVE-2022-393547.5SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the `is_static` param CVE-2022-393559.8Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper auth CVE-2022-393568.8Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can ente CVE-2022-393579.8Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9