CVE-2022-39364

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading `nextcloud.log` may gain knowledge of credentials to connect to a SharePoint service. Nextcloud Server versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server versions 22.2.10.5, 23.0.9, and 24.0.5 contain a patch for this issue. As a workaround, set `zend.exception_ignore_args = On` as an option in `php.ini`.

• CWE-312
• CWE-312

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qpf5-jj85-36h5Third Party Advisory
• https://github.com/nextcloud/server/pull/33689Patch, Third Party Advisory
• https://github.com/nextcloud/sharepoint/issues/141Exploit, Issue Tracking, Third Party Advisory
• https://hackerone.com/reports/1652903Permissions Required, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qpf5-jj85-36h5Third Party Advisory
• https://github.com/nextcloud/server/pull/33689Patch, Third Party Advisory
• https://github.com/nextcloud/sharepoint/issues/141Exploit, Issue Tracking, Third Party Advisory
• https://hackerone.com/reports/1652903Permissions Required, Third Party Advisory

Published

Oct 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39358Metabase is data visualization software. Prior to versions 0…6.5
• CVE-2022-39359Metabase is data visualization software. Prior to versions 0…6.5
• CVE-2022-3936The Team Members WordPress plugin before 5.2.1 does not sani…4.8
• CVE-2022-39360Metabase is data visualization software. Prior to versions 0…6.5
• CVE-2022-39361Metabase is data visualization software. Prior to versions 0…8.8
• CVE-2022-39362Metabase is data visualization software. Prior to versions 0…8.8
• CVE-2022-39365Pimcore is an open source data and experience management pla…9.8
• CVE-2022-39366DataHub is an open-source metadata platform. Prior to versio…9.8
• CVE-2022-39367QTIWorks is a software suite for standards-based assessment …6.5
• CVE-2022-39368Eclipse Californium is a Java implementation of RFC7252 - Co…8.2
• CVE-2022-39369phpCAS is an authentication library that allows PHP applicat…8
• CVE-2022-3937The Easy Video Player WordPress plugin before 1.2.2.3 does n…5.4