CVE-2021-41177 — Vulnetix

CVE-2021-41177 PUBLISHED CVSS 8.100000381469727 HIGH

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.

EPSS 0.62% · 70.4th percentile

Risk Scores

CVSS 3.1

8.100000381469727

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS Score

0.62%

70.4th percentile

Affected Products

Vendor	Product	Versions
nextcloud	nextcloud_server	0, 21.0.0, 22.0.0
nextcloud	security-advisories	< 20.0.13, >= 21.0.0, < 21.0.5, < 22.2.0

Exploit Intelligence

https://hackerone.com/reports/1265709 (nist-nvd)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fj39-4qx4-m3f2 (circl)
https://github.com/nextcloud/server/pull/28728 (circl)
GLSA-202208-17 (circl)

Timeline

Oct 25, 2021 CVE Published
Oct 26, 2021 EPSS Score
Dec 21, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Apr 12, 2022 EPSS Score
Jun 7, 2022 EPSS Score
Aug 3, 2022 EPSS Score
Sep 28, 2022 EPSS Score
Nov 23, 2022 EPSS Score
Jan 19, 2023 EPSS Score

References

Open in Interactive Console →