CVE-2021-32741

Lack of ratelimit on public share link mount endpoint

State: Published
Severity: 5.3 Medium
Published: Jul 12, 2021
Updated: Aug 3, 2024
Reserved: May 12, 2021

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	GitHub_M

Weaknesses

CWE-799 Improper Control of Interaction Frequency

Affected Products

Product	Versions
security-advisoriesnextcloud	< 19.0.13Affected >= 20.0.0, < 20.0.11Affected >= 21.0.0, < 21.0.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.