CVE-2021-41179

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-41179
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-41179.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-41179
Downstream
Related
Published
2021-10-25T22:15:07.990Z
Modified
2026-03-13T05:09:41.884459Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as @PublicPage could thus be accessed with a valid user session that isn't authenticated. This particularly affects the Nextcloud Talk application, as this could be leveraged to gain access to any private chat channel without going through the Two-Factor flow. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.

References

Affected packages

Git / github.com/nextcloud/server

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
9c053c66607a5c261bbf27a3db442addd9b5b6ee
Fixed
43a0a9a3213588d5f6fc88a0e52df6b8a0b9b9ec
Introduced
bd555dbe8568b2509bd7d82fabbe38d76c86afbe
Fixed
64e55fdd4a9ab38d5ad5e8fe457b2912e43efead
Introduced
1eea64f2c3eb0e110391c24830cea5f8d9c3e6a1
Fixed
07e359b7de671a81a7baad701d4496a9f871a770
Database specific 
{
    "versions": [
        {
            "introduced": "20.0.3"
        },
        {
            "fixed": "20.0.13"
        },
        {
            "introduced": "21.0.1"
        },
        {
            "fixed": "21.0.5"
        },
        {
            "introduced": "22.1.1"
        },
        {
            "fixed": "22.2.0"
        }
    ]
}

Affected versions

20.*
20.0.12rc1
v20.*
v20.0.10
v20.0.10RC1
v20.0.11
v20.0.11rc1
v20.0.12
v20.0.13rc1
v20.0.3
v20.0.4
v20.0.5
v20.0.5RC1
v20.0.5RC2
v20.0.6
v20.0.6RC1
v20.0.7
v20.0.7RC1
v20.0.8
v20.0.8RC1
v20.0.9
v20.0.9RC1
v21.*
v21.0.1
v21.0.2
v21.0.2RC1
v21.0.3
v21.0.3rc1
v21.0.4
v21.0.4rc1
v21.0.5rc1
v22.*
v22.1.1
v22.2.0rc2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-41179.json"