Vulnerability · Published Jun 1, 2021 · Assigned by GitHub_M
CVE-2021-32653Default settings leak federated cloud ID to lookup server of all users
Low 2.7
In plain English
A low-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)1.2%top 31.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup server even if the user has no fields set to published. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2; no workarounds outside the updates are known to exist.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | < 19.0.11>= 20.0.0, < 20.0.10>= 21.0.0, < 21.0.2 |
Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-396j-vqpr-qg45 x_refsource_CONFIRM
- https://hackerone.com/reports/1173436 x_refsource_MISC
- GLSA-202208-17 vendor-advisory, x_refsource_GENTOO