CVE-2021-32703: 
Linux Fedora vulnerability analysis and mitigation

Nextcloud Server, a package that handles data storage, was found to have a vulnerability due to lack of rate limiting on the shareinfo endpoint in versions prior to 19.0.13, 20.0.11, and 21.0.3. The vulnerability was discovered and disclosed in May 2021, with patches released in July 2021 (GitHub Advisory).

The vulnerability stems from the absence of rate limiting controls on the shareinfo endpoint, which could potentially be exploited to enumerate valid share tokens. The issue was tracked as CVE-2021-32703 and was classified as a Low severity vulnerability. The technical fix involved implementing bruteforce protection to the shareinfo endpoint, as evidenced by the patch implementation (Server PR).

The vulnerability could allow an attacker to enumerate potentially valid share tokens, potentially compromising the security of shared resources on the Nextcloud platform (GitHub Advisory).

While the vulnerability was classified as low severity, it could be exploited by making repeated requests to the shareinfo endpoint to enumerate valid share tokens. No known active exploits were reported in the wild (GitHub Advisory).

The vulnerability was fixed in Nextcloud Server versions 19.0.13, 20.0.11, and 21.0.3. No workarounds were available for this vulnerability, making upgrading to a patched version the only solution (Fedora Update).