Log in Start free

Vulnerability · Published Jul 12, 2021 · Assigned by GitHub_M

CVE-2021-32678Ratelimit not applied on OCS API responses

Low 3.7

In plain English

A low-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)1.4%top 27.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. No workarounds aside from upgrading are known to exist.

Affected products (as reported)

VendorProductVersions
nextcloud security-advisories < 19.0.13>= 20.0.0, < 20.0.11>= 21.0.0, < 21.0.3

Weakness: CWE-799 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References