Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator
Priority LOW 14CWE-261Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-326.
Summary
Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00461 40th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 24.0.3, 22.2.10, 23.0.7
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | 24.0.0 to before 24.0.3; before 22.2.10; 23.0.0 to before 23.0.7 | 24.0.3, 22.2.10, 23.0.7 | Patch available | CNA |
- security-advisories Vendornextcloud Affected 24.0.0 to before 24.0.3; before 22.2.10; 23.0.0 to before 23.0.7 Fixed in 24.0.3, 22.2.10, 23.0.7 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:password_policy:*:*:*:*:*:*:*:* | before 22.2.10; 23.0.0 to before 23.0.7; 24.0.0 to before 24.0.3 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:password_policy:*:*:*:*:*:*:*:* Versions before 22.2.10; 23.0.0 to before 23.0.7; 24.0.0 to before 24.0.3 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 24.0.3, 22.2.10, 23.0.7
Timeline
- 2026-10-02 Threatist record created from CVE-2022-35931
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences