CVE-2021-32766

Katalog CVE

CVSS 5.3 · Medium EPSS 1,3%

Kerentanan Generation of Error Message Containing Sensitive Information pada nextcloud server. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link share has been created with "Upload Only" privileges. (aka "File Drop"). A link share recipient is not expected to see which folders or files exist in a "File Drop" share. Using this vulnerability an attacker is able to enumerate folders in such a share. Exploitation requires that the attacker has access to a valid affected "File Drop" link share. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.0.1. Users who are unable to upgrade are advised to disable the Nextcloud Text application in the app settings.

Rincian

Terbit di NVD

7 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/text/pull/1716 patch · advisory pihak ketiga
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr advisory pihak ketiga
• https://hackerone.com/reports/1253475 permissions required · advisory pihak ketiga