CVE-2021-32703: Lack of ratelimit on shareinfo endpoint
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32703?
CVE-2021-32703 is classified as a medium severity vulnerability due to the potential for share token enumeration.
How do I fix CVE-2021-32703?
To fix CVE-2021-32703, update Nextcloud Server to version 19.0.13, 20.0.11, or 21.0.3 or later.
What versions are affected by CVE-2021-32703?
CVE-2021-32703 affects Nextcloud Server versions prior to 19.0.13, 20.0.11, and 21.0.3.
What can attackers do with CVE-2021-32703?
Attackers can potentially enumerate valid share tokens due to a lack of rate limiting on the shareinfo endpoint.
Is CVE-2021-32703 specific to any operating system?
CVE-2021-32703 is specific to Nextcloud Server and affects various versions but is also noted in Fedora versions 33 and 34.