CVE-2021-32734: File path disclosure of shared files in Nextcloud Text application
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud Text application in Nextcloud Server app settings.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32734?
CVE-2021-32734 has a medium severity due to potential exposure of sensitive information.
How do I fix CVE-2021-32734?
To fix CVE-2021-32734, upgrade Nextcloud Server to version 19.0.13, 20.0.11, or 21.0.3 or later.
What versions of Nextcloud Server are affected by CVE-2021-32734?
CVE-2021-32734 affects Nextcloud Server versions prior to 19.0.13, 20.0.11, and 21.0.3.
What is the risk of ignoring CVE-2021-32734?
Ignoring CVE-2021-32734 can lead to the disclosure of sensitive file paths that may assist an attacker.
Is there a workaround for CVE-2021-32734 if I can't upgrade?
There is no specific workaround for CVE-2021-32734; upgrading is the recommended approach to mitigate the vulnerability.