Vulnerability · Published Mar 10, 2022 · Assigned by GitHub_M

CVE-2021-41233Missing authorization in Nextcloud text

Medium 6.5

In plain English

A medium-severity missing authorization in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.8%top 43.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an attacker requires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud Server to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the Nextcloud Text application in the application settings.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 20.0.14>= 21.0.0, < 21.0.6>= 22.0.0, < 22.2.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-26c8-35cm-xq9m x_refsource_CONFIRM
https://github.com/nextcloud/text/pull/1884 x_refsource_MISC