CVE-2021-22913

Опубликовано: 11 июн. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server unless a global search has been explicitly chosen by the user.

Ссылки

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h8f6-wg82-6p7r
Third Party Advisory
https://hackerone.com/reports/1167958
Issue Tracking
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h8f6-wg82-6p7r
Third Party Advisory
https://hackerone.com/reports/1167958
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*

Версия до 1.2.7 (исключая)

cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*

Версия от 1.3.0 (включая) до 1.4.1 (исключая)

EPSS

Процентиль: 70%

0.00652

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200