CVE-2022-36289

What it actually does

Protection mechanism failure in the affected software allows an authenticated local user to trigger a denial of service condition.

Why it matters to the business

Local authenticated users may cause service disruptions and operational downtime; the issue affects widely used components with many downstream dependents, though exploitation probability remains low.

How an attack unfolds

An attacker with local authenticated access exploits the protection mechanism failure to induce a denial of service; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade nextcloud/richdocuments (GIT) to commit af719798f1481950c54ad76bff0eb90a59b04cb6 or later; no other mitigations are specified.

How to confirm the fix worked

Confirm the installed version matches or exceeds the fixed commit and verify that the protection mechanism now correctly enforces its intended restrictions under local authenticated access.

Typical attack path

1. Obtain local authenticated access to the system
2. Invoke the vulnerable code path through normal application interaction
3. Trigger the protection mechanism failure to cause denial of service

How to detect it

Review local authentication logs and application error logs for repeated or anomalous denial of service patterns originating from authenticated sessions; no specific threat actor indicators are known.

What your security team should do

• Apply the fixed commit to all instances without delay given the 1340 days since publication
• Audit local access controls and authentication boundaries around the affected component
• Incorporate version checks for this component into regular vulnerability scanning