CVE-2021-37629
Medium
Description
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended that the Nextcloud Richdocuments app is upgraded to either 3.8.4 or 4.2.1 to resolve. For users unable to upgrade it is recommended that the Richdocuments application be disabled.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Nextcloud Richdocuments
PublishedSep 7, 2021
First seenSep 7, 2021
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- nextcloud richdocuments3.8.4, 4.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nextcloud richdocuments | v < 3.8.4, 4.0.0 ≤ v < 4.2.1 | 3.8.4, 4.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.