CVE-2021-32734 LOW

CVE-2021-32734: File path disclosure of shared files in Nextcloud Text application

Vendor Nextcloud
Product security-advisories
Weakness CWE-209 · Error message info leak
Published July 12, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

3.1/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud Text application in Nextcloud Server app settings.

Key dates

02Disclosure timeline

July 12, 2021 CVE published
August 3, 2024 Record updated