CVE-2021-32707 MEDIUM

CVE-2021-32707: Bypass of image blocking in Nextcloud Mail

Vendor Nextcloud
Product security-advisories
Weakness CWE-20 · Input validation
Published July 12, 2021
Last update August 3, 2024

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images with a `background-image` CSS attribute. Note that the images were still passed through the Nextcloud image proxy, and thus there was no IP leakage. The issue was patched in version 1.9.6 and 1.10.0. No workarounds are known to exist.

Key dates

02Disclosure timeline

July 12, 2021 CVE published
August 3, 2024 Record updated