PT-2022-11375 · Nextcloud+1 · Nextcloud Text+2

Nickvergessen · Published 2022-03-10 · Updated 2022-09-27 · CVE-2021-41233

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 20.0.14 Nextcloud Server versions prior to 21.0.6 Nextcloud Server versions prior to 22.2.1

Description The Nextcloud Text application, which is shipped with Nextcloud Server by default, has an issue that allows an attacker to access the folder names of "File Drop" if they have knowledge of the sharing link.

Recommendations For versions prior to 20.0.14, upgrade to 20.0.14 or later. For versions prior to 21.0.6, upgrade to 21.0.6 or later. For versions prior to 22.2.1, upgrade to 22.2.1 or later. As a temporary workaround for users unable to upgrade, consider disabling the Nextcloud Text application in the application settings.

Fix

Missing Authorization

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-863

Related Identifiers

ALT-PU-2022-2504

ALT-PU-2022-2555

CVE-2021-41233

GHSA-26C8-35CM-XQ9M

Affected Products

Alt Linux

Nextcloud Server

Nextcloud Text

References · 6

• https://github.com/nextcloud/text/pull/1884 · Patch
• https://osv.dev/vulnerability/CVE-2021-41233 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41233 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-26c8-35cm-xq9m · Note
• https://t.me/cibsecurity/38746 · Telegram Post
• https://t.me/cvenotify/28065 · Telegram Post