CVE-2022-31649: 
ownCloud vulnerability analysis and mitigation

ownCloud owncloud/core before version 10.10.0 was found to have a vulnerability related to improper removal of sensitive information before storage or transfer. The vulnerability was discovered and disclosed in June 2022, affecting the settings page and API responses of several ownCloud applications that contained plaintext credentials (ownCloud Advisory).

The vulnerability has been assigned CVE-2022-31649 and is classified as CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). It received a CVSS v3 Base Score of 5.7 (Vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), indicating a medium severity level. The issue specifically involved the exposure of plaintext credentials in both the HTML interface of the settings page and various API responses (ownCloud Advisory).

The vulnerability could lead to the exposure of sensitive credentials and configuration information to unauthorized users who have access to the settings page or API responses. This information disclosure could potentially be leveraged for further attacks or unauthorized access to the system (ownCloud Advisory).

The vulnerability requires an authenticated user with access to the settings page or API endpoints to exploit. The attack complexity is considered low, but user interaction is required, as indicated by the CVSS metrics (ownCloud Advisory).

The vulnerability was addressed by removing the sensitive values from the HTML and API responses. Users are advised to upgrade to ownCloud version 10.10.0 or later to receive the security fix (ownCloud Advisory).