PT-2021-22471 · Nextcloud · Nextcloud Mail

Mihkelraba · Published 2021-10-25 · Updated 2022-08-05 · CVE-2021-39220

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 1.10.4 and 1.11.0

Description The Nextcloud Mail application has a privacy filter issue that fails to filter images with a relative protocol, potentially leaking the read state or user IP. This issue is due to the default behavior of not rendering images in emails.

Recommendations For versions prior to 1.10.4, upgrade to version 1.10.4. For versions prior to 1.11.0, upgrade to version 1.11.0. As a temporary workaround, consider disabling image rendering in emails until a patch is available.

Fix

Information Disclosure

RCE

Weakness Enumeration

CWE-200

CWE-20

Related Identifiers

CVE-2021-39220

GHSA-6Q9V-WM8R-RCV5

Affected Products

Nextcloud Mail

References · 7

• https://github.com/nextcloud/mail/pull/5470 · Patch
• https://osv.dev/vulnerability/CVE-2021-39220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39220 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q9v-wm8r-rcv5 · Note
• https://t.me/cvenotify/22480 · Telegram Post
• https://t.me/cvenotify/22365 · Telegram Post
• https://hackerone.com/reports/1308147 · Note