Vulnerability · Published Jun 1, 2021 · Assigned by GitHub_M
CVE-2021-32656Trusted servers exchange can be triggered by attacker
High 8.6
In plain English
A high-severity improper access control in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).
Official description
Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added as a federated share. This happens because Nextcloud supports sharing registered users with other Nextcloud servers, which can be done automatically when selecting the "Add server automatically once a federated share was created successfully" setting. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2 As a workaround, disable "Add server automatically once a federated share was created successfully" in the Nextcloud settings.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | < 19.0.11>= 20.0.0, < 20.0.10>= 21.0.0, < 21.0.2 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j875-vr2q-h6x6 x_refsource_CONFIRM
- https://hackerone.com/reports/1167853 x_refsource_MISC
- GLSA-202208-17 vendor-advisory, x_refsource_GENTOO