What’s Vulnerable › Vulnerabilities

CVE-2022-31118: Missing brute force protection on cloud federation sharing in Nextcloud Server

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-04 · updated 2026-06-17
• Weakness: CWE-770

Description

Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.

Affected products

• Nextcloud Server: before 22.2.9; from 23.0.0 before 23.0.6; from 24.0.0 before 24.0.2 — fixed in 22.2.9, 23.0.6, 24.0.2

How to fix

Upgrade to a fixed version: Nextcloud Server 22.2.9, 23.0.6, 24.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vwh-5v93-3vcq
• https://github.com/nextcloud/server/pull/32843/commits/6eb692da7fe73c899cb6a8d2aa045eddb1f14018
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vwh-5v93-3vcq
• https://github.com/nextcloud/server/pull/32843/commits/6eb692da7fe73c899cb6a8d2aa045eddb1f14018

Get alerted when CVE-2022-31118 or the next vulnerability affects your stack