Medium
Missing brute force protection on cloud federation sharing in Nextcloud Server
Type: advisorySources: OSV
Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-31118
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 04:01 UTC · Revision 1
Source evidence
Missing brute force protection on cloud federation sharing in Nextcloud Server
core-osv · Original sourcePublished 4 Aug 2022, 16:50 UTC
Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.
osv:CVE-2022-31118
Complete source record
{
"id": "028ca2abd63c0d98e7b2086e208aae47962691c59fb6d940001976c1a7ac05c0",
"url": "https://osv.dev/vulnerability/CVE-2022-31118",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Missing brute force protection on cloud federation sharing in Nextcloud Server",
"summary": "Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.",
"evidence": "osv:CVE-2022-31118",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2022-31118",
"aliases": [
"CVE-2022-31118",
"GHSA-2vwh-5v93-3vcq"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nextcloud/server",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b25810ea5173884285565297b8f1f29ed1b5ba01"
},
{
"introduced": "0619207f13792250aea775a2c3133d41ab625980"
},
{
"fixed": "a2b1f7c8b7071555553ba3e2a5c1dd93f8021b2e"
},
{
"introduced": "5f37aacb3194d51503aaa3529ae8f676b32a25d7"
},
{
"fixed": "2764c381a054ca8284975e70037e96411d2ce8f8"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "22.2.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "23.0.0"
},
{
"fixed": "23.0.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "24.0.0"
},
{
"fixed": "24.0.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v22.2.9rc1",
"v23.0.6rc1",
"v24.0.2rc1",
"v22.2.8",
"v23.0.5",
"v24.0.1",
"v22.2.8rc1",
"v23.0.5rc1",
"v24.0.1rc1",
"v24.0.0",
"v22.2.7",
"v23.0.4",
"v22.2.7rc1",
"v23.0.4rc1",
"v22.2.6",
"v23.0.3",
"v22.2.6rc2",
"v23.0.3rc2",
"v22.2.6rc1",
"v23.0.3rc1",
"v23.0.2",
"v22.2.5",
"v23.0.2rc1",
"v22.2.5rc1",
"v23.0.1",
"v22.2.4",
"v22.2.4rc3",
"v23.0.1rc3",
"v22.2.4rc2",
"v23.0.1rc2",
"v22.2.4rc1",
"v23.0.1rc1",
"v23.0.0",
"v22.2.3",
"v22.2.2",
"v22.2.1",
"v22.2.1rc1",
"v22.2.0",
"v22.2.0rc2",
"v22.1.1",
"v22.1.1rc2",
"v22.1.1rc1",
"v22.1.0",
"22.1.0",
"v22.1.0rc1",
"v22.0.0",
"v22.0.0rc2",
"v22.0.0rc1",
"v22.0.0beta5",
"v22.0.0beta4",
"v22.0.0beta2",
"v22.0.0beta1",
"v21.0.0beta8",
"v21.0.0beta7",
"v21.0.0beta6",
"v21.0.0beta5",
"v21.0.0beta4",
"v21.0.0beta3",
"v21.0.0beta2",
"v21.0.0beta1",
"v20.0.0RC1",
"v20.0.0beta4",
"v20.0.0beta3",
"v20.0.0beta2",
"v20.0.0beta1",
"v19.0.0RC2",
"v19.0.0RC1",
"v19.0.0beta7",
"v19.0.0beta6",
"v19.0.0beta5",
"v19.0.0beta4",
"v19.0.0beta3",
"v19.0.0beta2",
"v19.0.0beta1",
"v18.0.0RC1",
"v18.0.0beta4",
"v18.0.0beta3",
"v18.0.0beta2",
"v18.0.0beta1",
"v17.0.0beta4",
"v17.0.0beta3",
"v17.0.0beta2",
"v17.0.0beta1",
"v16.0.0RC1",
"v16.0.0beta3",
"v16.0.0beta2",
"v16.0.0beta1",
"v16.0.0alpha1",
"v15.0.0RC1",
"v15.0.0beta2",
"v15.0.0beta1",
"v14.0.0RC2",
"v14.0.0RC1",
"v14.0.0beta4",
"v14.0.0beta3",
"v14.0.0beta2",
"v14.0.0beta1",
"v13.0.0RC1",
"v13.0.0beta4",
"v13.0.0beta3",
"v13.0.0beta2",
"v13.0.0beta1",
"v12.0.0beta4",
"v12.0.0beta3",
"v12.0.0beta2",
"v12.0.0beta1",
"v11.0.0",
"v11.0RC2",
"v9.1.0beta1",
"v9.0.0beta2",
"v9.0beta1",
"v8.2RC1",
"v8.2beta1",
"v8.1RC2",
"v8.1.0beta2",
"v8.1.0beta1",
"v8.1.0alpha2",
"v8.1.0alpha1",
"v8.0.0",
"v8.0.0RC2",
"v8.0.0RC1",
"v8.0.0beta2",
"v8.0.0beta1",
"v8.0.0alpha2",
"v8.0.0alpha1",
"v7.0.0beta1",
"v7.0.0alpha2",
"v6.0.0RC2",
"v6.0.0RC1",
"v6.0.0beta5",
"v6.0.0beta4",
"v6.0.0beta3",
"v6.0.0beta2",
"v6.0.0alpha2",
"v5.0.0",
"v5.0.0RC3",
"v5.0.0RC2",
"v5.0.0RC1",
"v5.0.0beta2",
"v5.0.0beta1",
"v5.0.0alpha1",
"v4.5.0",
"v4.5.0RC3",
"v4.5.0RC2",
"v4.5.0RC1",
"v4.5.0beta4",
"v4.5.0beta3",
"v4.0.6",
"v4.0.5",
"v4.0.4",
"v4.0.1",
"v4.0.0",
"v4.0.0RC2",
"v4.0.0RC",
"v4.0.0beta",
"v3.0",
"v1.0.0beta1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31118.json"
}
}
],
"modified": "2026-10-28T02:30:46.801857301Z",
"provider": "osv",
"references": [
"https://github.com/nextcloud/server/pull/32843/commits/6eb692da7fe73c899cb6a8d2aa045eddb1f14018",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31118.json",
"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vwh-5v93-3vcq",
"https://nvd.nist.gov/vuln/detail/CVE-2022-31118"
],
"provider_metadata": {
"cwe_ids": [
"CWE-770"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31118.json"
}
},
"related_cves": [
{
"value": "CVE-2022-31118",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 514556,
"published_at": "2022-08-04T16:50:10+00:00"
}