CVE-2021-22879

Katalog CVE

CVSS 8.8 · High EPSS 5,0%

Kerentanan Improper Control of Resource Identifiers ('Resource Injection') pada nextcloud desktop, fedoraproject fedora. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.

Rincian

Terbit di NVD

14 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-99: Improper Control of Resource Identifiers ('Resource Injection')
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

5,0% peluang dieksploitasi; lebih tinggi dari 92,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://nextcloud.com/security/advisory/?id=NC-SA-2021-008 advisory vendor
• https://github.com/nextcloud/desktop/pull/2906 patch · advisory pihak ketiga
• https://hackerone.com/reports/1078002 exploit · advisory pihak ketiga
• https://security.gentoo.org/glsa/202105-37 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTWBJAS5DJJIK...