CVE-2021-41239CWE-200

User enumeration setting not respected in Nextcloud server

Medium · published March 8, 2022

CVSS v3.1
5.3
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01133 · 66.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-03-08T18:05Z
EPSS history
Timeline
  • 08 MAR 18:05Z
    User enumeration setting not respected in Nextcloud server
    cvelistv5