How severe is CVE-2022-29163?

CVE-2022-29163 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2022-29163 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (59th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-29163?

CVE-2022-29163 affects Nextcloud Nextcloud Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-29163?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-29163 published?

CVE-2022-29163 was published on 2022-05-20 and last updated on 2026-06-17.

CVE-2022-29163

CVE-2022-29163 is a low-severity vulnerability in Nextcloud Nextcloud Server with a CVSS 3.x base score of 3.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-671.

Key facts

Severity: Low (CVSS 3.x base score 3.5)
CVSS v2: 4.0
EPSS exploit prediction: 1% (59th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-671
Affected product: Nextcloud Nextcloud Server
Published: 2022-05-20
Last modified: 2026-06-17

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds.

Frequently asked questions

What is CVE-2022-29163?: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds.
How severe is CVE-2022-29163?: CVE-2022-29163 has a CVSS 3.x base score of 3.5, rated low severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2022-29163 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (59th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-29163?: CVE-2022-29163 affects Nextcloud Nextcloud Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-29163?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-29163 published?: CVE-2022-29163 was published on 2022-05-20 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*

More vulnerabilities in Nextcloud Nextcloud Server

CVE-2021-22915 — Critical (CVSS 9.8): Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6…
CVE-2021-32802 — Critical (CVSS 9.3): Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user…
CVE-2023-26482 — Critical (CVSS 9.0): Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed…
CVE-2021-32688 — High (CVSS 8.8): Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific…
CVE-2018-3775 — High (CVSS 8.8): Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user…
CVE-2023-35172 — High (CVSS 8.7): NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity…

All CVEs affecting Nextcloud Nextcloud Server →

Other CWE-671 vulnerabilities

CVE-2025-24024 — Critical (CVSS 9.1): Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member…
CVE-2018-13283 — High (CVSS 8.8): Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226…
CVE-2023-20115 — Medium (CVSS 5.4): A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in…

Browse all CWE-671 vulnerabilities →