CVEvulnerability

CVE-2022-35931

2.7 LOW Published 2022-09-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-09-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.7 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 ([email protected])
2.7 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-261, CWE-326

Description

Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available.

Affected configurations

• nextcloud password policy (< 22.2.10) • nextcloud password policy (>= 23.0.0 < 23.0.7) • nextcloud password policy (>= 24.0.0 < 24.0.3)

Related

Weakness · CWE (2)

  • CWE-261 Weak Encoding for Password weakness
  • CWE-326 Inadequate Encryption Strength weakness

References