PT-2021-21745 · Nextcloud · Nextcloud Circles

Bm402 · Published 2021-09-07 · Updated 2021-09-14 · CVE-2021-37630

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Circles versions prior to 0.19.15 Nextcloud Circles versions prior to 0.20.11 Nextcloud Circles versions prior to 0.21.4

Description The Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner, potentially leaking private information.

Recommendations For versions prior to 0.19.15, upgrade to 0.19.15. For versions prior to 0.20.11, upgrade to 0.20.11. For versions prior to 0.21.4, upgrade to 0.21.4. As a temporary workaround, consider restricting access to "Secret Circles" until the issue is resolved.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2021-37630

GHSA-56J9-3RJ4-WVGM

Affected Products

Nextcloud Circles

References · 6

• https://github.com/nextcloud/circles/pull/768 · Patch
• https://osv.dev/vulnerability/CVE-2021-37630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37630 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-56j9-3rj4-wvgm · Note
• https://t.me/cibsecurity/28397 · Telegram Post
• https://hackerone.com/reports/1257624 · Note