Skip to content

Generated passwords are not fully validated by HIBPValidator

Low
nickvergessen published GHSA-c7mw-9q4r-8qwr Sep 1, 2022

Package

Password Policy (Nextcloud)

Affected versions

< 22.2.10, < 23.0.7, < 24.0.3

Patched versions

22.2.10, 23.0.7, 24.0.3

Description

Impact

In very rare cases the random password generator may generate common passwords the validator itself would block.

Patches

It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3.

Workarounds

No workaround available

References

For more information

If you have any questions or comments about this advisory:

Severity

Low

CVE ID

CVE-2022-35931

Weaknesses