PT-2021-19873 · Nextcloud · Nextcloud Mail

Foobar7 · Published 2021-07-12 · Updated 2024-11-20 · CVE-2021-32707

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 1.9.6

Description The Nextcloud Mail application has an issue where the privacy filter fails to filter images with a background-image CSS attribute, potentially leaking the read state. However, images are still passed through the Nextcloud image proxy, preventing IP leakage.

Recommendations For versions prior to 1.9.6, update to version 1.9.6 or 1.10.0 to resolve the issue. At the moment, there is no information about other workarounds for this issue.

Exploit

Fix

Information Disclosure

RCE

Weakness Enumeration

CWE-200

CWE-20

Related Identifiers

CVE-2021-32707

GHSA-XXP4-44XC-8CRH

Affected Products

Nextcloud Mail

References · 7

• 🔥 https://hackerone.com/reports/1215251 · Exploit
• https://github.com/nextcloud/mail/pull/5189 · Patch
• https://osv.dev/vulnerability/CVE-2021-32707 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32707 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xxp4-44xc-8crh · Note
• https://t.me/cvenotify/102270 · Telegram Post
• https://t.me/cibsecurity/26076 · Telegram Post