CVE-2022-31120

    Dashboard / Vulnerabilities / CVE-2022-31120

    CVE-2022-31120

    Published: 4 Aug 2022Last Modified: 12 Aug 2026

    Summary: Federated share accepting/declining is not logged in audit log in Nextcloud Server

    Details: Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.

    References: https://github.com/nextcloud/server/pull/31594/commits/1d8bf9a89c6856218802a1d365000a5831be8655, https://portal.nextcloud.com/article/using-the-audit-log-44.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31120.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x, https://nvd.nist.gov/vuln/detail/CVE-2022-31120

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -7fcf8a6edc048a78fa2715f379e1202eb2533277

    Affected versions

    v22.2.7rc1
    v22.2.6
    v22.2.6rc2
    v22.2.6rc1
    v22.2.5
    v22.2.5rc1
    v22.2.4
    v22.2.4rc3
    v22.2.4rc2
    v22.2.4rc1
    v22.2.3
    v22.2.2
    v22.2.1
    v22.2.1rc1
    v22.2.0
    v22.2.0rc2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31120 | CVE-DB