PT-2021-15249 · Nextcloud+1 · Nextcloud+1

Alexander Hofstätter · Published 2021-03-03 · Updated 2022-09-27 · CVE-2021-22877

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud versions prior to 20.0.6

Description A missing user check in Nextcloud inadvertently populates a user's own credentials for other users' external storage configuration when not already configured yet.

Recommendations For Nextcloud versions prior to 20.0.6, update to version 20.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to external storage configurations to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

ALT-PU-2021-3108

ALT-PU-2021-3224

CVE-2021-22877

Affected Products

Alt Linux

Nextcloud

References · 10

• 🔥 https://github.com/nextcloud/server/issues/24600 · Exploit
• https://github.com/nextcloud/server/pull/25224 · Patch
• https://osv.dev/vulnerability/CVE-2021-22877 · Vendor Advisory
• https://nextcloud.com/security/advisory/?id=NC-SA-2021-004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22877 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6BO6P6MP2MOWA6PZRXX32PLWPXN5O4S · Vendor Advisory
• https://t.me/cibsecurity/24402 · Telegram Post
• https://hackerone.com/reports/1061591 · Note
• https://t.me/cvenotify/10819 · Telegram Post
• https://t.me/cvenotify/11136 · Telegram Post