CVE-2022-39330

Database resource exhaustion for logged-in users via sharee recommendations with circles

CVSS 4.8 MEDIUMEPSS 0.8%CWE-400

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.8EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

27 Oct 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by generating a lot of database/cpu load. Nextcloud Server versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server versions 22.2.10, 23.0.10, and 24.0.6 contain patches for this issue. As a workaround, disable the Circles app.

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Affected products

nextcloud · security-advisories

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/nextcloud/circles/pull/1147 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wxx7-w5p4-7x4c https://hackerone.com/reports/1688199