Threat of unauthorized user identifying users in the system
|Security Advisory Date||January 6, 2022|
|Vulnerability Type||User enumeration|
|Versions affected||All versions of FileCloud prior to Version 21.3.|
|Version fixed||FileCloud Version 18.104.22.16847|
Attackers who are not authorized to identify users in the system could obtain usernames by requesting share information on specified share paths. Since share paths include usernames, if share information is returned the attacker confirms that the username in the path exists.
This has been fixed in FileCloud version 22.214.171.12447 by blocking access to share paths for unauthenticated users and returning empty responses to the requests.
What you should do
- If you are using FileCloud on-premises, it is recommended that you update to the latest version, which is 126.96.36.19947 or greater. This will resolve the issue.
- If you are using FileCloud online, your site has already been updated to the latest version.
If you have any questions about this advisory, please contact FileCloud support.