CVE-2022-29163 : Security Advisory and Response

This article provides an overview of CVE-2022-29163, which involves the bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server.

Understanding CVE-2022-29163

CVE-2022-29163 highlights the security issue of creating a non-password-protected link even when the administrator mandates password protection in Nextcloud Server.

What is CVE-2022-29163?

CVE-2022-29163 pertains to Nextcloud Server, the file server software for Nextcloud. Versions 22.2.6 and 23.0.3 address the vulnerability that allowed users to bypass password requirements for shared folders.

The Impact of CVE-2022-29163

The vulnerability could compromise the security of shared folders by allowing unauthorized access when password protection is expected. The issue is rated with a CVSS base score of 3.5, indicating a low severity level with low confidentiality impact.

Technical Details of CVE-2022-29163

This section delves into the specifics of the CVE-2022-29163 vulnerability.

Vulnerability Description

Prior to versions 22.2.6 and 23.0.3, Nextcloud Server allowed users to create non-password-protected links for shared folders, disregarding administrator settings. The patched versions resolve this issue.

Affected Systems and Versions

Nextcloud Server versions prior to 22.2.6 and 23.0.3 are affected by this vulnerability, while versions 22.2.6 and 23.0.3 contain the necessary patches.

Exploitation Mechanism

The vulnerability enables users to share folders without password protection, circumventing the intended security measures set by administrators.

Mitigation and Prevention

To address CVE-2022-29163, certain steps can be taken to mitigate the risks associated with the vulnerability.

Immediate Steps to Take

Users are advised to update their Nextcloud Server installations to versions 22.2.6 or 23.0.3 to ensure the vulnerability is patched and no longer exploitable.

Long-Term Security Practices

Implementing robust security policies, including regular updates and monitoring, can enhance overall security posture and reduce the likelihood of similar vulnerabilities.

Patching and Updates

Staying current with the latest Nextcloud Server updates is crucial to protect against known vulnerabilities and ensure the security of shared folders.