CVE-2021-41239: User enumeration setting not respected in Nextcloud server
Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41239?
CVE-2021-41239 is considered a moderate severity vulnerability as it allows user enumeration under certain conditions.
How do I fix CVE-2021-41239?
To fix CVE-2021-41239, update Nextcloud Server to a version later than 20.0.14, and for versions 21.x, ensure you are on 21.0.6 or higher.
What versions of Nextcloud are affected by CVE-2021-41239?
Nextcloud versions from 20.0.0 to 20.0.14 and versions 21.0.0 to 21.0.6 are affected by CVE-2021-41239, along with version 22.2.0.
What functionality is compromised by CVE-2021-41239?
CVE-2021-41239 compromises the user enumeration settings, allowing unauthorized users to enumerate other users in the Nextcloud instance.
Is CVE-2021-41239 a critical vulnerability?
CVE-2021-41239 is not classified as critical but poses a risk by allowing user enumeration which could lead to further exploits.