Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

Related CPE's

a

nextcloud

nextcloud_server

3

o

fedoraproject

fedora

2

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fjv7-283f-5m54

Third Party Advisory

https://github.com/nextcloud/server/pull/27610

PatchThird Party Advisory

https://hackerone.com/reports/1192159

Permissions Required

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/

https://security.gentoo.org/glsa/202208-17

Third Party Advisory

Weaknesses

[email protected]

Primary
CWE-799

[email protected]

Secondary
CWE-307

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 · High

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2021-07-12T16:15:09.460

3 years ago

Last modified

2023-11-07T03:35:24.297

1 year ago