Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-35931

Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available.

Published

2022-09-06T18:15:15.813

Last Modified

2024-11-21T07:11:59.363

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 2.7 (LOW)

Weaknesses

Type: Secondary
CWE-261
Type: Primary
CWE-326

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	nextcloud	password_policy	< 22.2.10	Yes
Application	nextcloud	password_policy	< 23.0.7	Yes
Application	nextcloud	password_policy	< 24.0.3	Yes

References

https://github.com/nextcloud/password_policy/pull/363 Patch, Third Party Advisory ([email protected])
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7mw-9q4r-8qwr Third Party Advisory ([email protected])
https://github.com/nextcloud/password_policy/pull/363 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7mw-9q4r-8qwr Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)