Upstream information

CVE-2022-35931 at MITRE

Description

Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available.

SUSE information

Overall state of this security issue: Resolved

This issue is currently not rated by SUSE as it is not affecting the SUSE Enterprise products.

CVSS v3 Scores
  National Vulnerability Database
Base Score 2.7
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact Low
Availability Impact None
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1203190 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub 15 SP4
  • nextcloud >= 23.0.12-bp154.2.3.1
  • nextcloud-apache >= 23.0.12-bp154.2.3.1
 Patchnames:
openSUSE-2023-83
openSUSE Leap 15.4
  • nextcloud >= 23.0.12-bp154.2.3.1
  • nextcloud-apache >= 23.0.12-bp154.2.3.1
 Patchnames:
openSUSE-2023-83

SUSE Timeline for this CVE

CVE page created: Wed Sep 7 00:00:25 2022
CVE page last modified: Thu Apr 18 16:35:46 2024