CVE-2021-32703mediumCWE-799

CVE-2021-32703: medium-severity vulnerability in nextcloud security-advisories

Lack of ratelimit on shareinfo endpoint

Published · Updated

Follow this CVE+ Monitor security-advisories

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 1.5%
In short

The shareinfo endpoint in Nextcloud Server lacks rate limiting, allowing attackers to quickly guess and enumerate valid share tokens. This enables unauthorized access to shared files or folders.

Technical detail

The shareinfo endpoint fails to implement rate limiting controls (CWE-799), permitting an unauthenticated attacker to perform brute-force enumeration of share tokens through rapid sequential requests. Successful token enumeration grants access to shared resources without authorization.

Summary generated and translated by AI from the official description.
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
nextcloud · security-advisories
Related CVEs — nextcloud security-advisories

In the same product, most dangerous first.

CVE-2022-24838MEDIUMCommand Injection in Appointment Emails for Nextcloud CalendarEPSS 33.0%CVE-2023-26482CRITICALScope of workflow operations is not validated in nextcloud serverEPSS 4.2%CVE-2021-32802CRITICALPreview generation used third-party library not suited for user-generated content in Nextcloud serverEPSS 2.6%CVE-2022-31014MEDIUMSMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud ServerEPSS 2.5%CVE-2021-32688HIGHApplication specific tokens can change their own scopeEPSS 2.3%CVE-2021-37628HIGHFile Drop can be bypassed using Richdocuments app in nextcloudEPSS 2.1%