CVE-2021-41233: Missing authorization in Nextcloud text
Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an attacker requires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud Server to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the Nextcloud Text application in the application settings.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41233?
CVE-2021-41233 has a moderate severity level due to potential unauthorized access to folder names.
How do I fix CVE-2021-41233?
To resolve CVE-2021-41233, update your Nextcloud Server to a version beyond 20.0.14, or above 21.0.6 or 22.2.1.
Which versions of Nextcloud are affected by CVE-2021-41233?
CVE-2021-41233 affects Nextcloud Server versions up to 20.0.14 and versions between 21.0.0 and 21.0.6, as well as between 22.2.0 and 22.2.1.
Can an attacker exploit CVE-2021-41233 remotely?
Yes, an attacker can exploit CVE-2021-41233 remotely to gain access to file drop folder names.
Is there a workaround for CVE-2021-41233?
Currently, the best practice is to upgrade to a patched version of Nextcloud Server to mitigate CVE-2021-41233.