CVE-2022-35931: 
Linux openSUSE vulnerability analysis and mitigation

Nextcloud Password Policy, an app that enables server administrators to define password rules, contained a vulnerability (CVE-2022-35931) where the random password generator could potentially generate common passwords that would be blocked by its own validator. This vulnerability affected versions prior to 22.2.10, 23.0.7, and 24.0.3, and was disclosed on September 1, 2022 (Nextcloud Advisory).

The vulnerability was classified with a CVSS v3.1 score of 2.7 (LOW) and was associated with CWE-261. The technical issue involved the random password generator occasionally producing common passwords that would be rejected by the application's own HIBPValidator (Have I Been Pwned Validator), creating an inconsistency in the password security mechanism (NVD).

The impact of this vulnerability was relatively low, as it would only occur in very rare cases where the random password generator would create common passwords that should have been blocked by the validator. This could potentially lead to the creation of weaker passwords than intended by the security policy (Nextcloud Advisory).

The vulnerability was patched in Nextcloud Server versions 22.2.10, 23.0.7, and 24.0.3. No workarounds were available for this issue, making upgrading to a patched version the only solution (Nextcloud Advisory).