RSS   Podatności dla 'Richdocuments'   RSS

2021-10-25
 
CVE-2021-39223

NVD-CWE-noinfo
 
 
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the Richdocuments application is upgraded to 3.8.6 or 4.2.3. As a workaround, disable the Richdocuments application in the app settings.

 
2021-09-07
 
CVE-2021-37628

CWE-639
 
 
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features ("Upload Only" public link shares in Nextcloud) can be bypassed using the Nextcloud Richdocuments app. An attacker was able to read arbitrary files in such a share. It is recommended that the Nextcloud Richdocuments is upgraded to 3.8.4 or 4.2.1. If upgrading is not possible then it is recommended to disable the Richdocuments application.

 
 
CVE-2021-37629

CWE-770
 
 
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended that the Nextcloud Richdocuments app is upgraded to either 3.8.4 or 4.2.1 to resolve. For users unable to upgrade it is recommended that the Richdocuments application be disabled.

 

 >>> Vendor: Nextcloud 18 Produkty
Nextcloud
Nextcloud server
Calendar
TALK
Lookup-server
Server
Circles
DECK
Group folders
Nextcloud mail
Contacts
Preferred providers
Social
Desktop
Richdocuments
MAIL
Officeonline
NEWS

Copyright 2024, cxsecurity.com

 

Back to Top