{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-01T23:13:01.657","vulnerabilities":[{"cve":{"id":"CVE-2021-41179","sourceIdentifier":"security-advisories@github.com","published":"2021-10-25T22:15:07.990","lastModified":"2024-11-21T06:25:41.217","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as `@PublicPage` could thus be accessed with a valid user session that isn't authenticated. This particularly affects the Nextcloud Talk application, as this could be leveraged to gain access to any private chat channel without going through the Two-Factor flow. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading."},{"lang":"es","value":"Nextcloud es una plataforma de productividad de código abierto y auto-alojada. Nextcloud Server versiones 20.0.13, 21.0.5 y 22.2.0, la autenticación de dos factores no se aplicaba a las páginas marcadas como públicas. Por lo tanto, se podía acceder a cualquier página marcada como \"@PublicPage\" con una sesión de usuario válida que no estuviera autenticada. Esto afecta especialmente a la aplicación Nextcloud Talk, ya que podría aprovecharse para acceder a cualquier canal de chat privado sin pasar por el flujo de dos factores. Es recomendado actualizar el servidor Nextcloud a la versión 20.0.13, 21.0.5 o 22.2.0. No se presentan soluciones conocidas aparte de la actualización"}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-304"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:server:*:*:*:*:*:*:*:*","versionStartIncluding":"20.0.3","versionEndExcluding":"20.0.13","matchCriteriaId":"8CF59A46-813A-4F63-A748-B4B1787475A6"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:server:*:*:*:*:*:*:*:*","versionStartIncluding":"21.0.1","versionEndExcluding":"21.0.5","matchCriteriaId":"B8DBD42A-4D0B-4E74-9658-29325664880A"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:server:*:*:*:*:*:*:*:*","versionStartIncluding":"22.1.1","versionEndExcluding":"22.2.0","matchCriteriaId":"FABD6E21-6B12-460A-AA56-85C83D641E4E"}]}]}],"references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7hvh-rc6f-px23","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/nextcloud/server/pull/28725","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/1322865","source":"security-advisories@github.com","tags":["Permissions Required"]},{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7hvh-rc6f-px23","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/nextcloud/server/pull/28725","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://hackerone.com/reports/1322865","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required"]}]}}]}