CVE-2021-41177: Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database…

PriorityP345high8.1CVSS 3.1

AVNACLPRLUINSUCHINAH

EPSS

1.50%

71.1th percentile

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
nextcloud	nextcloud_server	< 20.0.13	20.0.13
nextcloud	nextcloud_server	>= 21.0.0 < 21.0.5	21.0.5
nextcloud	nextcloud_server	>= 22.0.0 < 22.2.0	22.2.0
nextcloud	security-advisories	< 20.0.13	20.0.13
nextcloud	security-advisories	< 22.2.0	22.2.0
nextcloud	security-advisories	—	—

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.