CVE-2022-35931: nextcloud password_policy Weak Encoding for Password
Vulnerability summary
CVE-2022-35931 is a low (CVSS 2.7) Weak Encoding for Password vulnerability in nextcloud password_policy. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 06-09-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud Server to 22.2.10, 23.0.7 or 24.0.3 to receive a patch for the issue in Password Policy. There are no known workarounds available.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
0.00 pp
From 0.45% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-261Weak Encoding for PasswordObscuring a password with a trivial encoding does not protect the password.
- CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Affected systems
Nextcloud2 products
- password_policy< 22.2.10 | ≥ 23.0.0, < 23.0.7 | ≥ 24.0.0, < 24.0.3
- security-advisories≥ 24.0.0, < 24.0.3 | < 22.2.10 | ≥ 23.0.0, < 23.0.7
1 vendor · 2 products
References
2 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-c7mw-9q4r-8qwrX Refsource CONFIRMThird Party Advisory