CVE-2022-29243

    Dashboard / Vulnerabilities / CVE-2022-29243

    CVE-2022-29243

    Published: 31 May 2022Last Modified: 12 Aug 2026

    Summary: Improper input-size validation on the user new session name in Nextcloud Server

    Details: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.

    References: https://hackerone.com/reports/1153138, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29243.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5w, https://nvd.nist.gov/vuln/detail/CVE-2022-29243, https://security.gentoo.org/glsa/202208-17, https://github.com/nextcloud/server/pull/31658

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -7fcf8a6edc048a78fa2715f379e1202eb2533277

    Affected versions

    v22.2.7rc1
    v22.2.6
    v22.2.6rc2
    v22.2.6rc1
    v22.2.5
    v22.2.5rc1
    v22.2.4
    v22.2.4rc3
    v22.2.4rc2
    v22.2.4rc1
    v22.2.3
    v22.2.2
    v22.2.1
    v22.2.1rc1
    v22.2.0
    v22.2.0rc2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-29243 | CVE-DB