Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-41968: Nextcloud Server's calendar name length not validated before writing to database

CVE-2022-41968 · published 3 years ago

Summary

Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
nextcloud	nextcloud_server	>= 23.0.0, < 23.0.10 >= 24.0.0, < 24.0.5 `cpe:2.3:a:nextcloud:nextcloud_server::::::::`

Original advisory text

Nextcloud Server's calendar name length not validated before writing to database

References

https://hackerone.com/reports/1596148 URL
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m92j-x... Vendor Advisory
https://github.com/nextcloud/server/pull/33139 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41968... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41968 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

3.5 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-400Uncontrolled Resource Consumption

CWE-1284Improper Validation of Specified Quantity in Input

Timeline

Published1 Dec 2022

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-41968 · NVD

CVE-2022-41968 · OSV

GHSA-m92j-xxc8-hq3v · GHSA

Track software like this

Free during beta