{"id":"CVE-2022-39346","aliases":["EUVD-2022-41818","GHSA-6w9f-jgjx-4vj6","openSUSE-SU-2023:0083-1"],"status":"published","title":"Missing length validation of user displayname in nextcloud server","description":"Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01096,"percentile":0.65861,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-400"],"published":"2022-11-25T00:00:00Z","modified":"2026-10-28T02:30:59Z","affected":[{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.12-bp154.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.12-bp154.2.3.1"}]}],"bundled":3}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"kiteworks","product":"security-advisories"},{"vendor":"nextcloud","product":"nextcloud_enterprise_server"},{"vendor":"nextcloud","product":"nextcloud_server"},{"vendor":"nextcloud","product":"security-advisories"}],"references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6w9f-jgjx-4vj6","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/nextcloud/server/pull/33052","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://hackerone.com/reports/1588562","tags":["x_transferred","Permissions Required","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TARDPRPBTI5TJRBYRVVQGTL6KWRCV5/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRAER4DCCHHSUDFHQ6LTIH4JEJFF73IU/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R32L3P53AQKQQC652LA5U3AWFTZKPDK3/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39346.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39346","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/M7E2FX5KGET4IYNWVYBLR7XYJMJ7SJD4/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203190","tags":["report"]},{"url":"https://bugzilla.suse.com/1205802","tags":["report"]},{"url":"https://bugzilla.suse.com/1208591","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-39346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25579","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-39346","title":"Missing length validation of user displayname in nextcloud server","description":"Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.","status":"published","published":"2022-11-25T00:00:00Z","modified":"2025-04-23T16:34:56.234Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-400","CWE-20"],"updated_at":"2026-11-02T14:34:39.559326Z"}],"euvd":[{"id":"EUVD-2022-41818","description":"Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.","status":"published","published":"2022-11-25T00:00:00Z","modified":"2025-04-23T16:34:56Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:52:12.313971Z"}],"nvd":[{"id":"CVE-2022-39346","description":"Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.","status":"published","published":"2022-11-25T19:15:11.623Z","modified":"2026-06-17T04:58:11.18Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-400"],"updated_at":"2026-11-02T14:07:32.827264Z"}],"osv":[{"id":"CVE-2022-39346","title":"Missing length validation of user displayname in nextcloud server","description":"Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.","status":"published","published":"2022-11-25T00:00:00Z","modified":"2026-10-28T02:30:59.525015487Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-20","CWE-400"],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"openSUSE-SU-2023:0083-1","title":"Security update for nextcloud","description":"This update for nextcloud fixes the following issues:\n\n- Update to 23.0.12\n  See: https://nextcloud.com/changelog/#latest23\n\n- This also fix security issues:\n  - CVE-2022-35931: Password Policy app could generate passwords that would be block (boo#1203190) \n  - CVE-2022-39346: Missing length validation of user displayname allows to generate an SQL error (boo#1205802)\n  - CVE-2023-25579: Potential directory traversal in OC\\Files\\Node\\Folder::getFullPath (boo#1208591)\n","status":"published","published":"2023-04-03T14:24:07Z","modified":"2026-02-04T02:19:54.35692Z","updated_at":"2026-11-02T16:58:32.653274Z"}]}}