CVE-2021-32741

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-799

Affected software

No affected versions have been published.

Timeline

Published: Jul 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327429.1Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for CVE-2021-327438.8Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data CVE-2021-327447.5Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are ab CVE-2021-327456.1Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-CVE-2021-327465.3Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` m CVE-2021-327476.5Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables ar CVE-2021-327484.3Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Platform Interface") pro CVE-2021-327498.1fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 CVE-2021-32756.1Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access P CVE-2021-327505.7MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop cli CVE-2021-327517.5Gradle is a build tool with a focus on build automation. In versions prior to 7.2, start scripts generated by the `application` plugin and t CVE-2021-327524.9Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to