Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2021-32678
CVE-2021-32678:
Linux Fedora vulnerability analysis and mitigation
Overview
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (OCSController) using the @BruteForceProtection annotation (GitHub Advisory).
Technical details
The vulnerability stems from the BaseResponse converter not taking over any throttling state from the DataResponse, which affects OCS API responses. The issue impacts any OCS API controller using the @BruteForceProtection annotation. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) (NVD).
Impact
The risk depends on the installed applications on the Nextcloud Server, with potential impacts ranging from bypassing authentication ratelimits to enabling spam attacks against other Nextcloud users (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in Nextcloud Server versions 19.0.13, 20.0.11, and 21.0.3. No workarounds aside from upgrading are known to exist (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Related Linux Fedora vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management