Vulnerability CVE-2021-32703


Published: 2021-07-12

Description:
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

Type:

CWE-307

(Improper Restriction of Excessive Authentication Attempts)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Nextcloud -> Nextcloud server 

 References:
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-375p-cxxq-gc9p
https://hackerone.com/reports/1173684
https://github.com/nextcloud/server/pull/26945

Copyright 2024, cxsecurity.com

 

Back to Top