Vulnerability Description
Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server unless a global search has been explicitly chosen by the user.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | Deck | < 1.2.7 |
Related Weaknesses (CWE)
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h8f6-wThird Party Advisory
- https://hackerone.com/reports/1167958Issue TrackingThird Party Advisory
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h8f6-wThird Party Advisory
- https://hackerone.com/reports/1167958Issue TrackingThird Party Advisory
FAQ
What is CVE-2021-22913?
CVE-2021-22913 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server unless...
How severe is CVE-2021-22913?
CVE-2021-22913 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-22913?
Check the references section above for vendor advisories and patch information. Affected products include: Nextcloud Deck.