Low severity · published Oct 25, 2021
CVE-2021-39220
Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to…
3.5
CVSS
0.9%
EPSS
No
On KEV
Description
Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended that the Nextcloud Mail application is upgraded to 1.10.4 or 1.11.0. There are no known workarounds aside from upgrading.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mail · Nextcloud
before 1.10.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-39220
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-39220
Patch
https://github.com/nextcloud/mail/pull/5470
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q9v-wm8r-rcv5
Permissions Required
https://hackerone.com/reports/1308147
More from Mail
9.8
CVE-2023-48307
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.1
CVE-2024-52508
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
7.0
CVE-2020-8156
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack
6.5
CVE-2023-23944
Nextcloud mail is an email app for the nextcloud home server platform