Skip to content
OpenAdvisories
Medium · 5.3 CVE-2021-37629 EUVD-2021-24185

Lack of ratelimit on Richdocuments OCS endpoint in nextcloud

Published Sep 7, 2021 · Updated Aug 4, 2024 · Assigned by GitHub_M

Description

Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended that the Nextcloud Richdocuments app is upgraded to either 3.8.4 or 4.2.1 to resolve. For users unable to upgrade it is recommended that the Richdocuments application be disabled.

Affected products

VendorProductAffectedFixed
nextcloud security-advisories < 3.8.4, >= 4.0.0, < 4.2.1 —

References