Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-98c1d712b5 advisory.

    Security fix for CVE-2022-39346

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0083-1 advisory.

  - Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for     passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare     cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to     22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known     workarounds available. (CVE-2022-35931)

  - Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not     properly limit user display names which could allow a malicious users to overload the backing database and     cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or     24.0.3. There are no known workarounds for this issue. (CVE-2022-39346)

  - Nextcloud server is a self hosted home cloud product. In affected versions the     `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong     order. The function is used in the `newFile()` and `newFolder()` items, which may allow to creation of     paths outside of ones own space and overwriting data from other users with crafted paths. This issue has     been addressed in versions 25.0.2, 24.0.8, and 23.0.12. Users are advised to upgrade. There are no known     workarounds for this issue. (CVE-2023-25579)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-902df3b060 advisory.

    Security fix for CVE-2022-39346

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-49b20342c0 advisory.

    Security fix for CVE-2022-39346

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211018	Fedora 37 : nextcloud (2022-98c1d712b5)	Nessus	Fedora Local Security Checks	medium
173828	openSUSE 15 Security Update : nextcloud (openSUSE-SU-2023:0083-1)	Nessus	SuSE Local Security Checks	high
169218	Fedora 36 : nextcloud (2022-902df3b060)	Nessus	Fedora Local Security Checks	medium
169107	Fedora 35 : nextcloud (2022-49b20342c0)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2022-39346

medium

Tenable Plugins

medium

high

medium

medium