Medium severity4.3NVD Advisory· Published May 31, 2022· Updated Jun 17, 2026

CVE-2022-29243

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nextcloud/Server2 versions
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*range: <22.2.7
- (no CPE)range: <22.2.7, <23.0.4
nextcloud/security-advisoriesv5
Range: < 22.2.7

Patches

Vulnerability mechanics

References

github.com/nextcloud/server/pull/31658nvdPatchThird Party Advisory
github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5wnvdThird Party Advisory
hackerone.com/reports/1153138nvdThird Party Advisory
security.gentoo.org/glsa/202208-17nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000