CVE-2021-39224 LOW

CVE-2021-39224: File path disclosure of shared files in OfficeOnline application

Vendor Nextcloud
Product security-advisories
Weakness CWE-200 · Info exposure
Published October 25, 2021
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

3.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the OfficeOnline application is upgraded to 1.1.1. As a workaround, one may disable the OfficeOnline application in the app settings.

Key dates

02Disclosure timeline

October 25, 2021 CVE published
August 4, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-11153 Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.5.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure CVE-2024-5615 Open Graph <= 1.11.2 - Unauthenticated Sensitive Information Exposure CVE-2014-125093 Ad Blocking Detector Plugin ad-blocking-detector.php information disclosure CVE-2025-12732 WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure CVE-2021-41124 Splash authentication credentials potentially leaked to target websites in scrapy-splash