CVE-2022-35931

Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator

State: Published
Severity: 2.7 Low
Published: Sep 6, 2022
Updated: Apr 23, 2025
Reserved: Jul 15, 2022

Description

Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available.

Scores

CVSS	Score	Vector	Source
3.1	2.7 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N	GitHub_M

Weaknesses

CWE-261 Weak Encoding for Password

Affected Products

Product	Versions
security-advisoriesnextcloud	>= 24.0.0, < 24.0.3Affected < 22.2.10Affected >= 23.0.0, < 23.0.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.