CVE-2021-41233

 

Published at: - 10-03-2022 10:15

Last modified: - 27-09-2022 05:42

Total changes: - 4

Description

Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an attacker requires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud Server to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the Nextcloud Text application in the application settings.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/nextcloud/text/pull/1884
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-26c8-35cm-xq9m

 

Keywords

NVD

 

CVE-2021-41233

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures