CVE-2021-32707

Katalog CVE

CVSS 4.3 · Medium EPSS 1,1%

Kerentanan Improper Input Validation pada nextcloud mail. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images with a `background-image` CSS attribute. Note that the images were still passed through the Nextcloud image proxy, and thus there was no IP leakage. The issue was patched in version 1.9.6 and 1.10.0. No workarounds are known to exist.

Rincian

Terbit di NVD

12 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/mail/pull/5189 patch · advisory pihak ketiga
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xxp4-44xc-8crh advisory pihak ketiga
• https://hackerone.com/reports/1215251 exploit · advisory pihak ketiga