Log in Start free

Vulnerability · Published Jul 12, 2021 · Assigned by GitHub_M

CVE-2021-32688Application specific tokens can change their own scope

High 8.8

In plain English

A high-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)2.3%top 16.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds aside from upgrading.

Affected products (as reported)

VendorProductVersions
nextcloud security-advisories < 19.0.13>= 20.0.0, < 20.0.11>= 21.0.0, < 21.0.3

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References