CVE-2021-32678CWE-799

Ratelimit not applied on OCS API responses

Low · published July 12, 2021

CVSS v3.1
3.7
EPSS
1%
Percentile
71.8
In the wild
Unconfirmed
What it is

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. No workarounds aside from upgrading are known to exist.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01374 · 71.8th percentile
Weakness
CWE-799 · Improper Control of Interaction Frequency
Published
2021-07-12T12:25Z
EPSS history
Timeline
  • 12 JUL 12:25Z
    Ratelimit not applied on OCS API responses
    cvelistv5