CVE-2021-32678

EPSS 0.3%
Veröffentlicht 12.07.2021 13:15:07
Zuletzt bearbeitet 21.11.2024 06:07:30
Quelle security-advisories@github.com
CVE-Watchlists
Login
Unerledigt
Login

Ratelimit not applied on OCS API responses

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. No workarounds aside from upgrading are known to exist.

Mögliche Gegenmaßnahme

Nextcloud Server: None.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 2 Referenzen 10

NVD 5 VulnDex Vulnerability Enrichment 2

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Nextcloud ≫ Nextcloud Server Version < 19.0.13

Nextcloud ≫ Nextcloud Server Version >= 20.0.0 < 20.0.11

Nextcloud ≫ Nextcloud Server Version >= 21.0.0 < 21.0.3

Fedoraproject ≫ Fedora Version33

Fedoraproject ≫ Fedora Version34

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Weitere Schwachstelleninformationen

SystemNextcloud

≫

Produkt Nextcloud Server

Version >= 0.0.0, < 19.0.13

Version >= 20.0.0, < 20.0.11

Version >= 21.0.0, < 21.0.3

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.3%	0.53

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N
security-advisories@github.com	3.7	2.2	1.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N