What is the CVSS score of CVE-2022-31131?

CVE-2022-31131 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.7%.

Is there a public PoC exploit available for CVE-2022-31131?

Yes, a public proof-of-concept exploit is available for CVE-2022-31131. Prioritise patching immediately. EPSS: 0.7%.

Is there a patch available for CVE-2022-31131?

Yes, a patch is available for CVE-2022-31131. Update the affected software to the latest version immediately.

Nextcloud CVE-2022-31131

MEDIUM

Improper Authentication (CWE-287)

2022-07-06 security-advisories@github.com

Authentication Bypass Nextcloud Nextcloud Mail

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Jul 06, 2022 - 18:15 nvd

MEDIUM 4.3

DescriptionNVD

Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended that the Nextcloud Mail app is upgraded to 1.12.2. There are no known workarounds for this issue.

Workarounds No workaround available

References * Pull request * HackerOne

For more information If you have any questions or comments about this advisory: * Create a post in nextcloud/security-advisories * Customers: Open a support ticket at support.nextcloud.com

AnalysisAI

Nextcloud mail is a Mail app for the Nextcloud home server product. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended that the Nextcloud Mail app is upgraded to 1.12.2. There are no known workarounds for this issue.

Workarounds No workaround available

References * Pull request * HackerOne

For more information If you have any questions or comments about this advisory: * Create a post in nextcloud/security-advisories * Customers: Open a support ticket at support.nextcloud.com Affected products include: Nextcloud Nextcloud Mail. Version information: prior to 1.12.2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.