Read the docs
TI-2022-18738 Aliases CVE-2022-39364

Exception logging in Sharepoint app reveals clear-text connection details

Priority MEDIUM 62CWE-312Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-312.

Summary

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading `nextcloud.log` may gain knowledge of credentials to connect to a SharePoint service. Nextcloud Server versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server versions 22.2.10.5, 23.0.9, and 24.0.5 contain a patch for this issue. As a workaround, set `zend.exception_ignore_args = On` as an option in `php.ini`.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00575 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed security-advisories (nextcloud): 22.2.10.5, 23.0.9, 24.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextcloudsecurity-advisoriesbefore 22.2.10.5; 23.0.0 to before 23.0.9; 24.0.0 to before 24.0.522.2.10.5, 23.0.9, 24.0.5Patch availableCNA
  • security-advisories Vendornextcloud Affected before 22.2.10.5; 23.0.0 to before 23.0.9; 24.0.0 to before 24.0.5 Fixed in 22.2.10.5, 23.0.9, 24.0.5 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:nextcloud:nextcloud_enterprise_server:*:*:*:*:*:*:*:*before 22.2.10.5; 23.0.0 to before 23.0.9; 24.0.0 to before 24.0.5Vulnerablenextcloud
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*before 23.0.9; 24.0.0 to before 24.0.5Vulnerablenextcloud
  • cpe:2.3:a:nextcloud:nextcloud_enterprise_server:*:*:*:*:*:*:*:* Versions before 22.2.10.5; 23.0.0 to before 23.0.9; 24.0.0 to before 24.0.5 Vulnerable ·nextcloud
  • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* Versions before 23.0.9; 24.0.0 to before 24.0.5 Vulnerable ·nextcloud

Remediation

  • Fix · CNA security-advisories (nextcloud) Fixed in 22.2.10.5, 23.0.9, 24.0.5

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39364

References

Exploit 1

Patch 1

Advisory 2

  • TI-2022-16497 Authentication headers exposed on by Nextcloud Server CVSS 3.1HIGH 7.5
  • TI-2022-18721 Missing length validation of user displayname in nextcloud server CVSS 3.1MEDIUM 6.5
  • TI-2022-18705 Profile of disabled user stays accessible CVSS 3.1MEDIUM 5.3
  • TI-2022-18590 Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server CVSS 3.1MEDIUM 5.3
  • TI-2022-18706 Database resource exhaustion for logged-in users via sharee recommendations with circles CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences