CVE-2021-41239 User enumeration setting not respected in Nextcloud server
Attackers can enumerate users on Nextcloud instances even when user listings are disabled, exposing user data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41239?
CVE-2021-41239 is a medium-severity vulnerability in Nextcloud Nextcloud Server, published on 8 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.
Which versions are affected by CVE-2021-41239?
It affects 1 product.
Products include Nextcloud Nextcloud Server.
How do I fix CVE-2021-41239?
Upgrade to a fixed version.
Is CVE-2021-41239 being exploited?
There is no known exploitation of CVE-2021-41239 in the wild and no public exploit code.
Other vulnerabilities in Nextcloud Nextcloud Server
- CVE-2021-32802 Preview generation used third-party library not suited for user-generated content in Nextcloud server
- CVE-2023-26482 Scope of workflow operations is not validated in nextcloud server
- CVE-2018-3775 Auth bypass in Nextcloud Server
- CVE-2023-35172 Nextcloud Server password reset endpoint is not brute force protected
- CVE-2023-32320 Nextcloud Server's brute force protection allows someone to send more requests than intended
Sources
Also known as GHSA-g722-cm3h-8wrx.