Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended that the Nextcloud Richdocuments app is upgraded to either 3.8.4 or 4.2.1 to resolve. For users unable to upgrade it is recommended that the Richdocuments application be disabled.
References
Link | Resource |
---|---|
https://github.com/nextcloud/richdocuments/pull/1663 | Third Party Advisory |
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gvvr-h36p-8mjx | Third Party Advisory |
https://hackerone.com/reports/1258750 | Permissions Required Third Party Advisory |
https://github.com/nextcloud/richdocuments/pull/1663 | Third Party Advisory |
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gvvr-h36p-8mjx | Third Party Advisory |
https://hackerone.com/reports/1258750 | Permissions Required Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:15
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/nextcloud/richdocuments/pull/1663 - Third Party Advisory | |
References | () https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gvvr-h36p-8mjx - Third Party Advisory | |
References | () https://hackerone.com/reports/1258750 - Permissions Required, Third Party Advisory |
14 Sep 2021, 16:16
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:nextcloud:richdocuments:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 5.3 |
References | (MISC) https://hackerone.com/reports/1258750 - Permissions Required, Third Party Advisory | |
References | (MISC) https://github.com/nextcloud/richdocuments/pull/1663 - Third Party Advisory | |
References | (CONFIRM) https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gvvr-h36p-8mjx - Third Party Advisory | |
CWE | CWE-770 |
07 Sep 2021, 21:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-09-07 21:15
Updated : 2024-11-21 06:15
NVD link : CVE-2021-37629
Mitre link : CVE-2021-37629
CVE.ORG link : CVE-2021-37629
JSON object : View
Products Affected
nextcloud
- richdocuments