PT-2021-19858 · Nextcloud · Nextcloud Talk

Rtod · Published 2021-07-12 · Updated 2022-07-02 · CVE-2021-32689

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Talk versions prior to 11.2.2 Nextcloud Talk versions prior to 11.3.0 can be simplified to the above, as versions prior to 11.2.2 already include versions prior to 11.3.0. Therefore, the simplified version is: Nextcloud Talk versions prior to 11.2.2

Description The issue allows a user to access any chat message sent to a previous user with a reused username. This can happen if a user is able to reuse an earlier used username.

Recommendations For versions prior to 11.2.2, update to version 11.2.2 or later to resolve the issue. As a temporary workaround, do not allow users to choose usernames themselves, to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-708

CWE-200

Related Identifiers

CVE-2021-32689

GHSA-XV6F-344W-895C

Affected Products

Nextcloud Talk

References · 7

• https://github.com/nextcloud/spreed/pull/5633 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32689 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32689 · Vendor Advisory
• https://github.com/nextcloud/spreed/releases/tag/v11.2.2 · Note
• https://github.com/nextcloud/spreed/releases/tag/v11.3.0 · Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xv6f-344w-895c · Note
• https://hackerone.com/reports/1200700 · Note