CVE-2021-32703

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-799 CWE-307

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 19.0.13; >= 20.0.0, < 20.0.11; >= 21.0.0, < 21.0.3

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-375p-cxxq-gc9pThird Party Advisory
https://github.com/nextcloud/server/pull/26945Patch, Third Party Advisory
https://hackerone.com/reports/1173684Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
https://security.gentoo.org/glsa/202208-17Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-375p-cxxq-gc9pThird Party Advisory
https://github.com/nextcloud/server/pull/26945Patch, Third Party Advisory
https://hackerone.com/reports/1173684Permissions Required
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
https://security.gentoo.org/glsa/202208-17Third Party Advisory

Timeline

Published: Jul 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327048.8DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerabilit CVE-2021-327057.5Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of rat CVE-2021-327068.8Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web int CVE-2021-327074.3Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images i CVE-2021-327088.1Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. CVE-2021-327094.9Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to up CVE-2021-32714.8PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all acti CVE-2021-327107.5Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to upd CVE-2021-327117.5Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only CVE-2021-327125.3Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. User CVE-2021-327134.8Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerabil CVE-2021-327149.1hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an intege