CRLF injection in Nextcloud Server - CVE-2022-31014

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU65375

CRLF injection in Nextcloud Server - CVE-2022-31014

Published: July 18, 2022


Vulnerability identifier: #VU65375
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-31014
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data in iCalendar Attachments to emails via newlines. A remote user can pass specially crafted data to the application containing CR-LF characters and modify application behavior.


Affected software

Nextcloud Server
Nextcloud Enterprise Server

How to mitigate CVE-2022-31014

Install updates from vendor's website.

Nextcloud Server - addressed in versions 22.2.8, 23.0.5, 24.0.1
Nextcloud Enterprise Server - addressed in versions 19.0.13.7, 20.0.14.6, 21.0.9.5, 22.2.8, 23.0.5

External References

Related Security Bulletins