Unrated severityNVD Advisory· Published Oct 25, 2021· Updated Aug 4, 2024
File path disclosure of shared files in OfficeOnline application
CVE-2021-39224
Description
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file shared.txt is located within /files/$username/Myfolder/Mysubfolder/shared.txt). It is recommended that the OfficeOnline application is upgraded to 1.1.1. As a workaround, one may disable the OfficeOnline application in the app settings.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: < 1.1.1
- nextcloud/security-advisoriesv5Range: < 1.1.1
Patches
Vulnerability mechanics
References
2- github.com/nextcloud/officeonline/pull/204mitrex_refsource_MISC
- github.com/nextcloud/security-advisories/security/advisories/GHSA-56wm-r6jm-3v9hmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.