Lucene search
GoogleOSV:CVE-2021-39224HistoryOct 25, 2021 - 10:15 p.m.
CVE-2021-39224
2021-10-2522:15:07
Google
osv.dev
6
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file shared.txt is located within /files/$username/Myfolder/Mysubfolder/shared.txt). It is recommended that the OfficeOnline application is upgraded to 1.1.1. As a workaround, one may disable the OfficeOnline application in the app settings.
| CPE | Name | Operator | Version |
|---|---|---|---|
| officeonline | eq | 1.0.0 | |
| officeonline | eq | 1.0.3 | |
| officeonline | eq | 1.1.0 | |
| officeonline | eq | 1.0.1 | |
| officeonline | eq | 1.0.0-alpha1 | |
| officeonline | eq | 1.0.2 |
Related
nvd
nvd
CVE-2021-39224
2021-10-25 22:15:07
nextcloud
nextcloud
File path disclosure of shared files in OfficeOnline application
2021-10-25 11:00:41
prion
prion
Path traversal
2021-10-25 22:15:00
cvelist
cvelist
cve
cve
CVE-2021-39224
2021-10-25 22:15:07
cnvd
cnvd
Nextcloud OfficeOnline Information Disclosure Vulnerability
2021-10-28 00:00:00