CVE-2021-22915

 

Published at: - 11-06-2021 06:15

Last modified: - 27-09-2022 04:09

Total changes: - 5

Description

Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://nextcloud.com/security/advisory/?id=NC-SA-2021-009
• https://hackerone.com/reports/1154003
• FEDORA-2021-afa7968aeb-Mailing List, Third Party Advisory
• FEDORA-2021-eac0e52f88-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2021-22915

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures