Riskcovery

CVE-2022-41969

Nextcloud Server has no password length limit when creating a user as an administrator

State
Published
Severity
2.4 Low
Published
Dec 1, 2022
Updated
Apr 23, 2025
Reserved
Sep 30, 2022

Read the record on cve.org

Description

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don't create user accounts with long passwords.

Scores

CVSSScoreVectorSource
3.12.4 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:LGitHub_M

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
security-advisoriesnextcloud
  • < 23.0.11Affected
  • >= 24.0.0, < 24.0.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.