CVE-2022-35931 Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator
The Nextcloud Password Policy app may generate weak passwords that bypass its own validation, requiring an upgrade to ensure proper security enforcement.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-35931?
CVE-2022-35931 is a low-severity vulnerability in nextcloud security-advisories, published on 6 Sep 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available.
Which versions are affected by CVE-2022-35931?
It affects 1 product.
Products include Nextcloud Password Policy.
How do I fix CVE-2022-35931?
Upgrade to a fixed version.
Is CVE-2022-35931 being exploited?
There is no known exploitation of CVE-2022-35931 in the wild and no public exploit code.
Sources
Also known as GHSA-c7mw-9q4r-8qwr.