CVE-2022-41969

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don't create user accounts with long passwords.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400 CWE-521

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 23.0.11; >= 24.0.0, < 24.0.7

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gm7-j7wg-m4fxThird Party Advisory
https://github.com/nextcloud/server/pull/34500Patch, Third Party Advisory
https://hackerone.com/reports/1727424Permissions Required, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gm7-j7wg-m4fxThird Party Advisory
https://github.com/nextcloud/server/pull/34500Patch, Third Party Advisory
https://hackerone.com/reports/1727424Permissions Required, Third Party Advisory

Timeline

Published: Dec 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-41974.8The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users s CVE-2022-419705.3Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download CVE-2022-419716.5Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests ca CVE-2022-419726.5Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 contain a NULL Pointer CVE-2022-419737.8multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. CVE-2022-419747.8multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-202 CVE-2022-419757.8RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode.CVE-2022-419768.8An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application CVE-2022-419773.3An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A specially CVE-2022-419786.5Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress.CVE-2022-419798.8Protection mechanism failure in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalatio CVE-2022-41984.8The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users