VulnerabilityModified
CVE-2021-32734
This could result in a full path disclosure on shared files.
MEDIUM 5.3EPSS 1.38%
Does this matter?
Lower severity and a low EPSS score (1.38%). Track it; it rarely justifies an emergency change on its own.
Description
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud Text application in Nextcloud Server app settings.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.38% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-209
- Affected
- nextcloud/nextcloud server
- Source
- security-advisories@github.com
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6hf5-c2c4-2526Third Party Advisory
- https://github.com/nextcloud/text/pull/1695Patch, Third Party Advisory
- https://hackerone.com/reports/1246721Permissions Required
- https://security.gentoo.org/glsa/202208-17Third Party Advisory
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6hf5-c2c4-2526Third Party Advisory
- https://github.com/nextcloud/text/pull/1695Patch, Third Party Advisory
- https://hackerone.com/reports/1246721Permissions Required
- https://security.gentoo.org/glsa/202208-17Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.