← Zuruck zu CVEs
CVE-2021-32705
MEDIUM5.3
Beschreibung
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
CVE Details
CVSS v3.1 Bewertung5.3
SchweregradMEDIUM
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienNONE
BenutzerinteraktionNONE
Veroffentlicht7/12/2021
Zuletzt geandert11/21/2024
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
fedoraproject:fedoranextcloud:nextcloud_server
Schwachen (CWE)
CWE-799CWE-307
Referenzen
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fjv7-283f-5m54(security-advisories@github.com)
https://github.com/nextcloud/server/pull/27610(security-advisories@github.com)
https://hackerone.com/reports/1192159(security-advisories@github.com)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/(security-advisories@github.com)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/(security-advisories@github.com)
https://security.gentoo.org/glsa/202208-17(security-advisories@github.com)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fjv7-283f-5m54(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/nextcloud/server/pull/27610(af854a3a-2127-422b-91ae-364da2661108)
https://hackerone.com/reports/1192159(af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/(af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/(af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202208-17(af854a3a-2127-422b-91ae-364da2661108)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.