PT-2021-19832 · Nextcloud+1 · Nextcloud Server+1

Rtod · Published 2021-06-01 · Updated 2022-10-26 · CVE-2021-32654

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 19.0.11 Nextcloud Server versions prior to 20.0.10 Nextcloud Server versions prior to 21.0.2

Description The issue allows an attacker to gain write/read privileges on any Federated File Share. This can also be exploited on any public link, as public links can be added as a federated file share.

Recommendations For versions prior to 19.0.11, upgrade to version 19.0.11 or disable federated file sharing as a workaround. For versions prior to 20.0.10, upgrade to version 20.0.10 or disable federated file sharing as a workaround. For versions prior to 21.0.2, upgrade to version 21.0.2 or disable federated file sharing as a workaround.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

ALT-PU-2021-3108

ALT-PU-2021-3224

CVE-2021-32654

GHSA-JF9H-V24C-22G5

Affected Products

Alt Linux

Nextcloud Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-32654 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32654 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-17 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf9h-v24c-22g5 · Note
• https://hackerone.com/reports/1170024 · Note