Missing length validation of user displayname in nextcloud server
Priority LOW 31CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.
Summary
Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01096 65th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 22.2.10, 23.0.7, 24.0.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | before 22.2.10; 23.0.0 to before 23.0.7; 24.0.0 to before 24.0.3 | 22.2.10, 23.0.7, 24.0.3 | Patch available | CNA |
- security-advisories Vendornextcloud Affected before 22.2.10; 23.0.0 to before 23.0.7; 24.0.0 to before 24.0.3 Fixed in 22.2.10, 23.0.7, 24.0.3 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:nextcloud_enterprise_server:*:*:*:*:*:*:*:* | before 22.2.10; 23.0.0 to before 23.0.7; 24.0.0 to before 24.0.3 | Vulnerable | nextcloud |
| cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | before 22.2.10; 23.0.0 to before 23.0.7; 24.0.0 to before 24.0.3 | Vulnerable | nextcloud |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:nextcloud:nextcloud_enterprise_server:*:*:*:*:*:*:*:* Versions before 22.2.10; 23.0.0 to before 23.0.7; 24.0.0 to before 24.0.3 Vulnerable ·nextcloud
- cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* Versions before 22.2.10; 23.0.0 to before 23.0.7; 24.0.0 to before 24.0.3 Vulnerable ·nextcloud
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 22.2.10, 23.0.7, 24.0.3
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2022-39346
References
More Nextcloud Enterprise Server vulnerabilities
- TI-2022-18738 Exception logging in Sharepoint app reveals clear-text connection details CVSS 3.1MEDIUM 6.5
- TI-2022-16497 Authentication headers exposed on by Nextcloud Server CVSS 3.1HIGH 7.5
- TI-2022-18705 Profile of disabled user stays accessible CVSS 3.1MEDIUM 5.3
- TI-2022-18590 Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server CVSS 3.1MEDIUM 5.3
- TI-2022-18706 Database resource exhaustion for logged-in users via sharee recommendations with circles CVSS 3.1MEDIUM 4.8
Sources
- CVE-2022-39346 · CVE Program
- CVE-2022-39346 · NVD
- FIRST EPSS
- CVE-2022-39346 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences