Vulnerability · Published Sep 7, 2021 · Assigned by GitHub_M
CVE-2021-37631Circle can be accessed by non-Circle members in Nextcloud Deck
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Official description
Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't properly check membership of users in a Circle. This allowed other users in the instance to gain access to boards that have been shared with a Circle, even if the user was not a member of the circle. It is recommended that Nextcloud Deck is upgraded to 1.5.1, 1.4.4 or 1.2.9. If you are unable to update it is advised to disable the Deck plugin.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | < 1.2.9>= 1.3.0, < 1.4.4>= 1.5.0, < 1.5.1 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mxp-j277-82hr x_refsource_CONFIRM
- https://github.com/nextcloud/deck/pull/3217 x_refsource_MISC
- https://hackerone.com/reports/1256021 x_refsource_MISC
- https://hackerone.com/reports/1280931 x_refsource_MISC