Vulnerability · Published Jun 16, 2021 · Assigned by GitHub_M

CVE-2021-32676Session Fixation in Nextcloud Talk

Medium 6.5

In plain English

A medium-severity session fixation in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.0%top 38.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended that the Nextcloud Talk App is upgraded to 9.0.10, 10.0.8 or 11.2.2. No workarounds for this vulnerability are known to exist.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 9.0.10>= 10.0.0, < 10.0.8>= 11.0.0, < 11.2.2

Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p6h7-84v4-827r x_refsource_CONFIRM
https://hackerone.com/reports/1181962 x_refsource_MISC