{"id":"CVE-2021-41177","aliases":["EUVD-2021-28279","GHSA-fj39-4qx4-m3f2","openSUSE-SU-2021:1602-1"],"status":"published","title":"Rate-limits not working on instances without configured memory cache backend","description":"Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0155,"percentile":0.75405,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-799"],"published":"2021-10-25T21:50:11Z","modified":"2026-10-20T10:54:57Z","affected":[{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.14-bp153.2.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.14-bp153.2.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.14-bp153.2.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.14-bp153.2.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.14-bp153.2.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.14-bp153.2.9.1"}]}],"bundled":3}],"products":[{"vendor":"kiteworks","product":"security-advisories"},{"vendor":"nextcloud","product":"nextcloud_server"},{"vendor":"nextcloud","product":"security-advisories"}],"references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fj39-4qx4-m3f2","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/nextcloud/server/pull/28728","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://hackerone.com/reports/1265709","tags":["x_refsource_MISC","x_transferred","Permissions Required","Third Party Advisory","report"]},{"url":"https://security.gentoo.org/glsa/202208-17","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YPS4NA73653ZFLPRD3JJVTUZZ4PYGDUS/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1192028","tags":["report"]},{"url":"https://bugzilla.suse.com/1192030","tags":["report"]},{"url":"https://bugzilla.suse.com/1192031","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41179","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-41177","title":"Rate-limits not working on instances without configured memory cache backend","description":"Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.","status":"published","published":"2021-10-25T21:50:11Z","modified":"2024-08-04T02:59:31.688Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-799"],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-28279","description":"Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.","status":"published","published":"2021-10-25T21:50:11Z","modified":"2024-08-04T02:59:31Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:24:18.784846Z"}],"nvd":[{"id":"CVE-2021-41177","description":"Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.","status":"published","published":"2021-10-25T22:15:07.847Z","modified":"2026-06-17T04:08:01.87Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-799"],"updated_at":"2026-11-02T14:07:00.137719Z"}],"osv":[{"id":"CVE-2021-41177","description":"Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.","status":"published","published":"2021-10-25T22:15:07.847Z","modified":"2026-10-20T10:54:57.690242589Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"openSUSE-SU-2021:1602-1","title":"Security update for nextcloud","description":"\nThis update for nextcloud fixes the following issues:\n\nUpdate to 20.0.14\n\nSecurity issues fixed:\n\n* CVE-2021-41179: Fix boo#1192028 - (CWE-304): Two-Factor Authentication not enforced for pages marked as public\n* CVE-2021-41178: Fix boo#1192030 - (CWE-434): File Traversal affecting SVG files on Nextcloud Server\n* CVE-2021-41177: Fix boo#1192031 - (CWE-799): Rate-limits not working on instances without configured memory cache backend\n\nChanges:\n\n- Add command to repair broken filesystem trees (server#26630)\n- Ensure that user and group IDs in LDAP's tables are also max 64chars (server#28971)\n- Change output format of Psalm to Github (server#29048)\n- File-upload: Correctly handle error responses for HTTP2 (server#29069)\n- Allow 'TwoFactor Nextcloud Notifications' to pull the state of the 2F… (server#29072)\n- Add a few sensitive config keys (server#29085)\n- Fix path of file_get_contents (server#29095)\n- Update the certificate bundle (server#29098)\n- Keep pw based auth tokens valid when pw-less login happens (server#29131)\n- Properly handle folder deletion on external s3 storage (server#29158)\n- Tokens without password should not trigger changed password invalidation (server#29166)\n- Don't further setup disabled users when logging in with apache (server#29167)\n- Add 'supported'-label to all supported apps (server#29181)\n- 21] generate a better optimized query for path prefix search filters (server#29192)\n- Keep group restrictions when reenabling apps after an update (server#29198)\n- Add proper message to created share not found (server#29205)\n- Add documentation for files_no_background_scan (server#29219)\n- Don't setup the filesystem to check for a favicon we don't use anyway (server#29223)\n- Fix background scan doc in config (server#29253)\n- Get `filesize()` if `file_exists()` (server#29290)\n- Fix unable to login errors due to file system not being initialized (server#29291)\n- Update 3rdparty ref (server#29297)\n- Bump icewind/streams from 0.7.3 to 0.7.5 in files_external (server#29298)\n- Fix app upgrade (server#29303)\n- Avoid PHP errors when the LDAP attribute is not found (server#29314)\n- Fix security issues when copying groupfolder with advanced ACL (server#29366)\n- Scheduling plugin not updating responding attendee status (server#29387)\n- Make calendar schedule options translatable (server#29388)\n- Add whitelist for apps inside of the server repo (server#29396)\n- Handle files with `is_file` instead of `file_exists` (server#29417)\n- Fixes an undefined index when getAccessList returns an empty array (server#29421)\n- Extra fixes needed for icewind/streams update to 0.7.2 (server#29426)\n- Backport #29260: Respect user enumeration settings in user status lists (server#29429)\n- Implement local filtering in file list (server#29441)\n- Detect mimetype by content only with content (server#29457)\n- Update CRL (server#29505)\n- Update update-psalm-baseline workflow (server#29548)\n- Bump icewind/streams from 0.7.1 to 0.7.5 (3rdparty#855)\n- Bump version (files_pdfviewer#512)\n- Fix deleting notifications with numeric user ID (notifications#1090)\n- Add integration tests for push registration (notifications#1097)\n- Restore old device signature so the proxy works again (notifications#1105)\n- Bump vue and vue-template-compiler (photos#864)\n- Bump prosemirror-schema-list from 1.1.5 to 1.1.6 (text#1868)\n- Additional checks for workspace controller (text#1887)\n","status":"published","published":"2021-12-20T10:28:56Z","modified":"2026-02-04T03:58:42.049473Z","updated_at":"2026-11-02T16:58:32.266854Z"}]}}