{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T02:45:08.762","vulnerabilities":[{"cve":{"id":"CVE-2021-41241","sourceIdentifier":"security-advisories@github.com","published":"2022-03-08T19:15:07.927","lastModified":"2026-06-17T04:08:09.333","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting \"advanced permissions\" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the \"groupfolders\" application in the admin settings."},{"lang":"es","value":"El servidor de Nextcloud es un sistema autoalojado diseñado para proporcionar servicios de estilo en la nube. La aplicación groupfolders para Nextcloud permite compartir una carpeta con un grupo de personas. Además, permite establecer \"permisos avanzados\" en las subcarpetas, por ejemplo, un usuario podría tener acceso a la carpeta de grupo pero no a subcarpetas específicas. Debido a la falta de comprobación de permisos en las versiones afectadas, un usuario podría seguir accediendo a estas subcarpetas copiando la carpeta de grupo a otra ubicación. Se recomienda actualizar el servidor Nextcloud a la versión 20.0.14, 21.0.6 o 22.2.1. Los usuarios que no puedan actualizarse deberán desactivar la aplicación \"groupfolders\" en la configuración del administrador"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nextcloud","product":"security-advisories","versions":[{"version":"< 20.0.14","status":"affected"},{"version":">= 21.0.0, < 21.0.6","status":"affected"},{"version":">= 22.2.0, < 22.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T14:09:27.827049Z","id":"CVE-2021-41241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*","versionEndExcluding":"20.0.14","matchCriteriaId":"FE354750-B4B3-4F0A-8B59-472C527BC7B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*","versionStartIncluding":"21.0.0","versionEndExcluding":"21.0.6","matchCriteriaId":"467AE8CC-B050-4A69-AD8A-88C71C69C898"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:22.2.0:*:*:*:*:*:*:*","matchCriteriaId":"0FB174BF-D3FD-49C6-B216-3166DE1AD6F9"}]}]}],"references":[{"url":"https://github.com/nextcloud/groupfolders/issues/1692","source":"security-advisories@github.com","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m4wp-r357-4q94","source":"security-advisories@github.com","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/nextcloud/server/pull/29362","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202208-17","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/nextcloud/groupfolders/issues/1692","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m4wp-r357-4q94","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/nextcloud/server/pull/29362","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202208-17","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}