CVE-2021-37628CWE-639

File Drop can be bypassed using Richdocuments app in nextcloud

High · published September 7, 2021

CVSS v3.1
7.5
EPSS
2%
Percentile
81.5
In the wild
Unconfirmed
What it is

Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features ("Upload Only" public link shares in Nextcloud) can be bypassed using the Nextcloud Richdocuments app. An attacker was able to read arbitrary files in such a share. It is recommended that the Nextcloud Richdocuments is upgraded to 3.8.4 or 4.2.1. If upgrading is not possible then it is recommended to disable the Richdocuments application.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02090 · 81.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2021-09-07T20:15Z
EPSS history
Timeline
  • 07 SEP 20:15Z
    File Drop can be bypassed using Richdocuments app in nextcloud
    cvelistv5