CVE-2021-41177: nextcloud nextcloud_server
Vulnerability summary
CVE-2021-41177 is a high (CVSS 8.1) vulnerability in nextcloud nextcloud_server. EPSS estimates a 1.55% chance of exploitation in the next 30 days, higher than 74.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 25-10-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
1.55%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
0.00 pp
From 1.55% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Nextcloud2 products
- nextcloud_server< 20.0.13 | ≥ 21.0.0, < 21.0.5 | ≥ 22.0.0, < 22.2.0
- security-advisories< 20.0.13 | ≥ 21.0.0, < 21.0.5 | < 22.2.0
1 vendor · 2 products
References
4 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-fj39-4qx4-m3f2X Refsource CONFIRMThird Party Advisory