Description

Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended that the Nextcloud Richdocuments app is upgraded to either 3.8.4 or 4.2.1 to resolve. For users unable to upgrade it is recommended that the Richdocuments application be disabled.

Related CPE's

a

nextcloud

richdocuments

2

References

https://github.com/nextcloud/richdocuments/pull/1663

Third Party Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gvvr-h36p-8mjx

Third Party Advisory

https://hackerone.com/reports/1258750

Permissions RequiredThird Party Advisory

Weaknesses

[email protected]

Primary
CWE-770

[email protected]

Secondary
CWE-200

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.3 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2021-09-07T21:15:08.807

3 years ago

Last modified

2021-09-14T16:16:36.343

3 years ago