PT-2022-11377 · Nextcloud+1 · Nextcloud Server+1

Mejo- + 1 · Published 2022-03-08 · Updated 2022-10-24 · CVE-2021-41239

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 20.0.14 Nextcloud Server versions prior to 21.0.6 Nextcloud Server versions prior to 22.2.1

Description The Nextcloud server is a self-hosted system designed to provide cloud-style services. In affected versions, the User Status API did not consider the user enumeration settings set by the administrator. This allowed a user to enumerate other users on the instance, even when user listings were disabled.

Recommendations For versions prior to 20.0.14, upgrade to 20.0.14. For versions prior to 21.0.6, upgrade to 21.0.6. For versions prior to 22.2.1, upgrade to 22.2.1. As a temporary workaround, consider disabling the User Status API until a patch is available.

Fix

Information Disclosure

Missing Authorization

Weakness Enumeration

CWE-200

CWE-862

Related Identifiers

ALT-PU-2022-2504

ALT-PU-2022-2555

CVE-2021-41239

GHSA-G722-CM3H-8WRX

OPENSUSE-SU-2022:0089-1

OPENSUSE-SU-2022:0098-1

Affected Products

Alt Linux

Nextcloud Server

References · 19

• https://github.com/nextcloud/server/issues/27122 · Patch
• https://github.com/nextcloud/server/pull/29260 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:0098-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0089-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41239 · Security Note
• https://security.gentoo.org/glsa/202208-17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41239 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g722-cm3h-8wrx · Note
• https://t.me/cvenotify/27920 · Telegram Post
• https://suse.com/security/cve/CVE-2021-41239 · Note
• https://t.me/cvenotify/27908 · Telegram Post
• https://bugzilla.suse.com/1196908 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/EZTHEQMMIKP2RX3EBMXDQAOIVUPMCDFB · Note
• https://suse.com/security/cve/CVE-2021-41741 · Note
• https://t.me/cibsecurity/38542 · Telegram Post