CVE-2021-37629CWE-200

Lack of ratelimit on Richdocuments OCS endpoint in nextcloud

Medium · published September 7, 2021

CVSS v3.1
5.3
EPSS
1%
Percentile
71.9
In the wild
Unconfirmed
What it is

Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended that the Nextcloud Richdocuments app is upgraded to either 3.8.4 or 4.2.1 to resolve. For users unable to upgrade it is recommended that the Richdocuments application be disabled.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01380 · 71.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-09-07T20:25Z
EPSS history
Timeline
  • 07 SEP 20:25Z
    Lack of ratelimit on Richdocuments OCS endpoint in nextcloud
    cvelistv5