Riskcovery

CVE-2021-39220

Bypass of image blocking in Nextcloud Mail

State
Published
Severity
3.5 Low
Published
Oct 25, 2021
Updated
Aug 4, 2024
Reserved
Aug 16, 2021

Read the record on cve.org

Description

Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended that the Nextcloud Mail application is upgraded to 1.10.4 or 1.11.0. There are no known workarounds aside from upgrading.

Scores

CVSSScoreVectorSource
3.13.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:NGitHub_M

Weaknesses

  • CWE-20 Improper Input Validation
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
security-advisoriesnextcloud
  • < 1.10.4, < 1.11.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.