NVD Vulnerability Detail

CVE-2021-32703

Summary	Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
Publication Date	July 13, 2021, 1:15 a.m.
Registration Date	July 13, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:07 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:nextcloud:nextcloud_server::::::::	21.0.0			21.0.3
cpe:2.3:a:nextcloud:nextcloud_server::::::::	20.0.0			20.0.11
cpe:2.3:a:nextcloud:nextcloud_server::::::::				19.0.13

Related information, measures and tools

No	URL	タグ
1	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-375p-cxxq-gc9p	Third Party Advisory
2	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-375p-cxxq-gc9p	Third Party Advisory
3	https://github.com/nextcloud/server/pull/26945	Patch Third Party Advisory
4	https://github.com/nextcloud/server/pull/26945	Patch Third Party Advisory
5	https://hackerone.com/reports/1173684	Permissions Required
6	https://hackerone.com/reports/1173684	Permissions Required
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
11	https://security.gentoo.org/glsa/202208-17	Third Party Advisory
12	https://security.gentoo.org/glsa/202208-17	Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Nextcloud Server における過度な認証試行の不適切な制限に関する脆弱性

Title	Nextcloud Server における過度な認証試行の不適切な制限に関する脆弱性
Summary	Nextcloud Server には、過度な認証試行の不適切な制限に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 12, 2021, midnight
Registration Date	April 12, 2022, 5:47 p.m.
Last Update	April 12, 2022, 5:47 p.m.

Affected System

Fedora Project

Fedora

Nextcloud

Nextcloud Server 19.0.13 未満

Nextcloud Server 20.0.11 未満

Nextcloud Server 21.0.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-32703	https://www.cve.org/CVERecord?id=CVE-2021-32703
National Vulnerability Database (NVD)
2	CVE-2021-32703	https://nvd.nist.gov/vuln/detail/CVE-2021-32703

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-307	https://cwe.mitre.org/data/definitions/307.html

ベンダー情報

No	Name	URL
Fedora Update Notification
1	FEDORA-2021-6f327296fe	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
2	FEDORA-2021-9b421b78af	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
GitHub
3	Add bruteforce protection to the shareinfo endpoint #26945	https://github.com/nextcloud/server/pull/26945
4	Lack of ratelimit on shareinfo endpoint	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-375p-cxxq-gc9p

Change Log

No	Changed Details	Date of change
1	[2022年03月28日] 掲載	March 28, 2022, 2:25 p.m.