CVE-2022-31119 Password disclosure in log file in Nextcloud Mail App

Low 3.1 Published 4 Aug 2022 Updated 23 Apr 2025

Nextcloud Mail logs user passwords to disk during misconfiguration, allowing attackers with log access to take over accounts.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-31119?

CVE-2022-31119 is a low-severity vulnerability in nextcloud security-advisories, published on 4 Aug 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to the logs complete access to affected accounts would be obtainable. It is recommended that the Nextcloud Mail is upgraded to 1.12.1. Operators should inspect their logs and remove passwords which have been logged. There are no workarounds to prevent logging in the event of a misconfiguration.

Weakness: CWE-532

Which versions are affected by CVE-2022-31119?

It affects 1 product.

Products include Nextcloud Mail.

How do I fix CVE-2022-31119?

No fix has been published for CVE-2022-31119 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-31119 being exploited?

There is no known exploitation of CVE-2022-31119 in the wild and no public exploit code.

Sources

Also known as GHSA-63m3-w68h-3wjg.