cnvd - cnvd-2022-18419

cnvd-2022-18419

Vulnerability from cnvd

Title: Nextcloud存在未明漏洞（CNVD-2022-18419）

Description:

Nextcloud是德国Nextcloud公司的一套开源的自托管文件同步和共享的通信应用平台。

Nextcloud Text存在安全漏洞，攻击者可利用该漏洞枚举此类共享中的文件夹。

Severity: 中

Patch Name: Nextcloud存在未明漏洞（CNVD-2022-18419）的补丁

Patch Description:

Nextcloud是德国Nextcloud公司的一套开源的自托管文件同步和共享的通信应用平台。

Nextcloud Text存在安全漏洞，攻击者可利用该漏洞枚举此类共享中的文件夹。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr

Reference: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr

Impacted products

Name
['Nextcloud Nextcloud <20.0.12', 'Nextcloud Nextcloud <21.0.4', 'Nextcloud NextCloud Talk <22.0.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-32766",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-32766"
    }
  },
  "description": "Nextcloud\u662f\u5fb7\u56fdNextcloud\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u81ea\u6258\u7ba1\u6587\u4ef6\u540c\u6b65\u548c\u5171\u4eab\u7684\u901a\u4fe1\u5e94\u7528\u5e73\u53f0\u3002\n\nNextcloud Text\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u679a\u4e3e\u6b64\u7c7b\u5171\u4eab\u4e2d\u7684\u6587\u4ef6\u5939\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-18419",
  "openTime": "2022-03-11",
  "patchDescription": "Nextcloud\u662f\u5fb7\u56fdNextcloud\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u81ea\u6258\u7ba1\u6587\u4ef6\u540c\u6b65\u548c\u5171\u4eab\u7684\u901a\u4fe1\u5e94\u7528\u5e73\u53f0\u3002\r\n\r\nNextcloud Text\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u679a\u4e3e\u6b64\u7c7b\u5171\u4eab\u4e2d\u7684\u6587\u4ef6\u5939\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Nextcloud\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2022-18419\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Nextcloud Nextcloud \u003c20.0.12",
      "Nextcloud Nextcloud \u003c21.0.4",
      "Nextcloud NextCloud Talk \u003c22.0.1"
    ]
  },
  "referenceLink": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr",
  "serverity": "\u4e2d",
  "submitTime": "2021-09-10",
  "title": "Nextcloud\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2022-18419\uff09"
}

CVE-2021-32766 (GCVE-0-2021-32766)

Vulnerability from cvelistv5

Published

2021-09-07 21:05

Modified

2024-08-03 23:33

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-209 - Generation of Error Message Containing Sensitive Information

Summary

Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link share has been created with "Upload Only" privileges. (aka "File Drop"). A link share recipient is not expected to see which folders or files exist in a "File Drop" share. Using this vulnerability an attacker is able to enumerate folders in such a share. Exploitation requires that the attacker has access to a valid affected "File Drop" link share. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.0.1. Users who are unable to upgrade are advised to disable the Nextcloud Text application in the app settings.

References

▼	URL	Tags
	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr	x_refsource_CONFIRM
	https://github.com/nextcloud/text/pull/1716	x_refsource_MISC
	https://hackerone.com/reports/1253475	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	nextcloud	security-advisories	Version: < 20.0.12 Version: >= 21.0.0, < 21.0.4 Version: >= 22.0.0, < 22.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:33:55.653Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nextcloud/text/pull/1716"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1253475"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "security-advisories",
          "vendor": "nextcloud",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.0.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 21.0.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0, \u003c 22.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link share has been created with \"Upload Only\" privileges. (aka \"File Drop\"). A link share recipient is not expected to see which folders or files exist in a \"File Drop\" share. Using this vulnerability an attacker is able to enumerate folders in such a share. Exploitation requires that the attacker has access to a valid affected \"File Drop\" link share. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.0.1. Users who are unable to upgrade are advised to disable the Nextcloud Text application in the app settings."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-07T21:05:11",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/text/pull/1716"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/1253475"
        }
      ],
      "source": {
        "advisory": "GHSA-gcf3-3wmc-88jr",
        "discovery": "UNKNOWN"
      },
      "title": "Nextcloud Text app can disclose existence of folders in \"File Drop\" link share",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-32766",
          "STATE": "PUBLIC",
          "TITLE": "Nextcloud Text app can disclose existence of folders in \"File Drop\" link share"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "security-advisories",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 20.0.12"
                          },
                          {
                            "version_value": "\u003e= 21.0.0, \u003c 21.0.4"
                          },
                          {
                            "version_value": "\u003e= 22.0.0, \u003c 22.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "nextcloud"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link share has been created with \"Upload Only\" privileges. (aka \"File Drop\"). A link share recipient is not expected to see which folders or files exist in a \"File Drop\" share. Using this vulnerability an attacker is able to enumerate folders in such a share. Exploitation requires that the attacker has access to a valid affected \"File Drop\" link share. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.0.1. Users who are unable to upgrade are advised to disable the Nextcloud Text application in the app settings."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-209: Generation of Error Message Containing Sensitive Information"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr",
              "refsource": "CONFIRM",
              "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gcf3-3wmc-88jr"
            },
            {
              "name": "https://github.com/nextcloud/text/pull/1716",
              "refsource": "MISC",
              "url": "https://github.com/nextcloud/text/pull/1716"
            },
            {
              "name": "https://hackerone.com/reports/1253475",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/1253475"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-gcf3-3wmc-88jr",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-32766",
    "datePublished": "2021-09-07T21:05:11",
    "dateReserved": "2021-05-12T00:00:00",
    "dateUpdated": "2024-08-03T23:33:55.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted