Every CVE Search/ Get API key

CVE-2022-31120

Federated share accepting/declining is not logged in audit log in Nextcloud Server

2.1 Low

Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.90%Unchanged since Aug 5, 2022
90%50%10%1%

What each source reports

CVE List Score used 2.1

Federated share accepting/declining is not logged in audit log in Nextcloud Server

Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.

Record
CVE-2022-31120
CVSS 3.1
2.1 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-778
Updated
2026-11-02
EUVDEUVD-2022-52754 2.1

Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.

Record
EUVD-2022-52754
CVSS 3.1
2.1 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
NVD 2.1

Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.

Record
CVE-2022-31120
CVSS 3.1
2.1 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1
2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-778
Updated
2026-11-02
OSV 2.1

Federated share accepting/declining is not logged in audit log in Nextcloud Server

Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.

Record
CVE-2022-31120
CVSS 3.1
2.1 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-778
Updated
2026-11-02

Affected products

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31120 is a low vulnerability (CVSS 2.1) in Nextcloud Server, published August 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open