CVE-2021-22879 | BDVDB-2026-152104 Detail
Nextcloud Desktop Client
Description#
Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.
Impact#
No impact statement in the source data.
Weaknesses#
- CWE-99 Resource Injection (CWE-99)
References#
- https://hackerone.com/reports/1078002
- https://nextcloud.com/security/advisory/?id=NC-SA-2021-008
- https://github.com/nextcloud/desktop/pull/2906
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTWBJAS5DJJIK7LLVBZZQTSJASUVIRVE/
- https://security.gentoo.org/glsa/202105-37
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.