CVE-2021-41178
Description
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishing attack, an attacker could upload a malicious SVG file that mimics the Nextcloud login form and send a specially crafted link to victims. The XSS risk here is mitigated due to the fact that Nextcloud employs a strict Content-Security-Policy disallowing execution of arbitrary JavaScript. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10- osv-coords6 versionspkg:rpm/opensuse/nextcloud&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/nextcloud&distro=openSUSE%20Leap%2015.3pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2012pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2015%20SP1pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2015%20SP2pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2015%20SP3
< 20.0.14-bp153.2.9.1+ 5 more
- (no CPE)range: < 20.0.14-bp153.2.9.1
- (no CPE)range: < 20.0.14-bp153.2.9.1
- (no CPE)range: < 20.0.14-bp153.2.9.1
- (no CPE)range: < 20.0.14-bp153.2.9.1
- (no CPE)range: < 20.0.14-bp153.2.9.1
- (no CPE)range: < 20.0.14-bp153.2.9.1
- nextcloud/security-advisoriesv5Range: 20.0.13
Patches
Vulnerability mechanics
References
4- github.com/nextcloud/server/pull/28726nvdPatchThird Party Advisory
- github.com/nextcloud/security-advisories/security/advisories/GHSA-jp9c-vpr3-m5rfnvdThird Party Advisory
- security.gentoo.org/glsa/202208-17nvdThird Party Advisory
- hackerone.com/reports/1302155nvdPermissions Required
News mentions
0No linked articles in our index yet.