Related Vulnerabilities: CVE-2022-29163  

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds.

Description

The MITRE CVE dictionary describes this issue as:

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds.

Additional Information

  • Bugzilla 2089615: CVE-2022-29163 nextcloud: user can create a link that is not password protected even if the administrator requires it
  • CWE-671: Lack of Administrator Control over Security
  • FAQ: Frequently asked questions about CVE-2022-29163