{"id":"CVE-2021-22879","aliases":["DEBIAN-CVE-2021-22879","EUVD-2021-10014","GHSA-vrvw-x9cv-3j76","UBUNTU-CVE-2021-22879","openSUSE-SU-2021:0577-1","openSUSE-SU-2024:11088-1"],"status":"published","title":"Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing...","description":"Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.05036,"percentile":0.92387,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-99"],"published":"2021-04-14T12:41:24Z","modified":"2026-10-23T18:03:25Z","fixes":[{"ecosystem":"Debian:12","package":"nextcloud-desktop","fixed_in":["3.1.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nextcloud-desktop","fixed_in":["3.1.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nextcloud-desktop","fixed_in":["3.1.1-2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"nextcloud-desktop","fixed_in":["3.1.3-lp152.2.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nextcloud-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nextcloud-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nextcloud-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-2"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nextcloud-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.3-1","2.6.0-1","2.6.1-1","2.6.1-2","2.6.2-1","2.6.2-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nextcloud-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.3-0ubuntu1","3.3.5-1","3.3.5-1ubuntu1","3.4.2-1","3.4.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nextcloud-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.0-1","3.10.0-1","3.11.0-1","3.11.0-1.1build3","3.11.0-1.1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nextcloud-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.0-1","3.16.2-1","3.16.4-1","3.16.6-1","3.16.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nextcloud-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.6-1","33.0.2-1","33.0.7-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nextcloud-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.6-3","3.16.7-1","4.0.1-2","4.0.1-2build1","4.0.6-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nextcloud-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-lp152.2.6.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nextcloud","product":"desktop"}],"references":[{"url":"https://hackerone.com/reports/1078002","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://nextcloud.com/security/advisory/?id=NC-SA-2021-008","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/nextcloud/desktop/pull/2906","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTWBJAS5DJJIK7LLVBZZQTSJASUVIRVE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202105-37","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22879"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTWBJAS5DJJIK7LLVBZZQTSJASUVIRVE/"},{"url":"https://github.com/advisories/GHSA-vrvw-x9cv-3j76"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-22879","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-22879","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22879","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YL7MF53UDFP75PXEIEPNXBAJQBN6ZIBB/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184770","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22879","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-22879","description":"Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.","status":"published","published":"2021-04-14T12:41:24Z","modified":"2024-08-03T18:51:07.486Z","cwes":["CWE-99"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2021-10014","description":"Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.","status":"published","published":"2021-04-14T12:41:24Z","modified":"2024-08-03T18:51:07Z","updated_at":"2026-11-03T03:25:01.606931Z"}],"ghsa":[{"id":"GHSA-vrvw-x9cv-3j76","title":"Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing...","description":"Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.","status":"published","published":"2022-05-24T17:47:33Z","modified":"2023-01-29T05:02:39Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:45:08.540426Z"}],"nvd":[{"id":"CVE-2021-22879","description":"Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.","status":"published","published":"2021-04-14T13:15:13.04Z","modified":"2026-06-17T03:37:56.147Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-99","CWE-74"],"updated_at":"2026-11-02T14:06:51.610648Z"}],"osv":[{"id":"CVE-2021-22879","description":"Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.","status":"published","published":"2021-04-14T13:15:13.04Z","modified":"2026-10-20T10:54:31.185873144Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-22879","description":"Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.","status":"published","published":"2021-04-14T13:15:13.04Z","modified":"2026-10-23T18:03:25.088681172Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-22879","description":"Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.","status":"published","published":"2021-04-14T13:15:00Z","modified":"2026-10-17T12:56:18.952502636Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"openSUSE-SU-2021:0577-1","title":"Security update for nextcloud-desktop","description":"This update for nextcloud-desktop fixes the following issues:\n\nnextcloud-desktop was updated to 3.1.3:\n\n- desktop#2884 [stable-3.1] Add support for Hirsute\n- desktop#2920 [stable-3.1] Validate sensitive URLs to onle allow http(s) schemes.\n- desktop#2926 [stable-3.1] Validate the providers ssl certificate\n- desktop#2939 Bump release to 3.1.3\n\nThis also fix security issues:\n\n- (boo#1184770, CVE-2021-22879, NC-SA-2021-008 , CWE-99)\n\n  Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource\n  injection by way of missing validation of URLs, allowing a \n  malicious server to execute remote commands.\n  User interaction is needed for exploitation. \n","status":"published","published":"2021-04-19T12:08:02Z","modified":"2026-02-04T03:13:04.635264Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11088-1","title":"caja-extension-nextcloud-3.3.4-1.1 on GA media","description":"These are all security issues fixed in the caja-extension-nextcloud-3.3.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:53:13.261091Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}