PT-2021-19849 · Nextcloud · Nextcloud Talk

Rtod · Published 2021-06-16 · Updated 2021-06-23 · CVE-2021-32676

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Talk versions prior to 9.0.10 Nextcloud Talk versions prior to 10.0.8 Nextcloud Talk versions prior to 11.2.2

Description Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk did not rotate the session cookie after a successful authentication event.

Recommendations For versions prior to 9.0.10, upgrade to version 9.0.10. For versions prior to 10.0.8, upgrade to version 10.0.8. For versions prior to 11.2.2, upgrade to version 11.2.2.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2021-32676

GHSA-P6H7-84V4-827R

Affected Products

Nextcloud Talk

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-32676 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32676 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p6h7-84v4-827r · Note
• https://hackerone.com/reports/1181962 · Note
• https://t.me/cvenotify/16414 · Telegram Post