CVE-2022-31118

    Dashboard / Vulnerabilities / CVE-2022-31118

    CVE-2022-31118

    Published: 4 Aug 2022Last Modified: 12 Aug 2026

    Summary: Missing brute force protection on cloud federation sharing in Nextcloud Server

    Details: Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.

    References: https://github.com/nextcloud/server/pull/32843/commits/6eb692da7fe73c899cb6a8d2aa045eddb1f14018, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31118.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vwh-5v93-3vcq, https://nvd.nist.gov/vuln/detail/CVE-2022-31118

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -b25810ea5173884285565297b8f1f29ed1b5ba01

    Affected versions

    v22.2.9rc1
    v22.2.8
    v22.2.8rc1
    v22.2.7
    v22.2.7rc1
    v22.2.6
    v22.2.6rc2
    v22.2.6rc1
    v22.2.5
    v22.2.5rc1
    v22.2.4
    v22.2.4rc3
    v22.2.4rc2
    v22.2.4rc1
    v22.2.3
    v22.2.2
    v22.2.1
    v22.2.1rc1
    v22.2.0
    v22.2.0rc2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31118 | CVE-DB