CVE-2021-32734CWE-209

File path disclosure of shared files in Nextcloud Text application

Low · published July 12, 2021

CVSS v3.1
3.1
EPSS
1%
Percentile
71.9
In the wild
Unconfirmed
What it is

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud Text application in Nextcloud Server app settings.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01381 · 71.9th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2021-07-12T21:45Z
EPSS history
Timeline
  • 12 JUL 21:45Z
    File path disclosure of shared files in Nextcloud Text application
    cvelistv5