Vulnerability · Published Sep 7, 2021 · Assigned by GitHub_M

CVE-2021-37628File Drop can be bypassed using Richdocuments app in nextcloud

High 7.5

In plain English

A high-severity authorization bypass via user-controlled key in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)2.1%top 18.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features ("Upload Only" public link shares in Nextcloud) can be bypassed using the Nextcloud Richdocuments app. An attacker was able to read arbitrary files in such a share. It is recommended that the Nextcloud Richdocuments is upgraded to 3.8.4 or 4.2.1. If upgrading is not possible then it is recommended to disable the Richdocuments application.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 3.8.4>= 4.0.0, < 4.2.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pxhh-954f-8w7w x_refsource_CONFIRM
https://github.com/nextcloud/richdocuments/pull/1664 x_refsource_MISC
https://hackerone.com/reports/1253403 x_refsource_MISC