PT-2021-21746 · Nextcloud · Nextcloud Deck

Bm402 · Published 2021-09-07 · Updated 2021-09-14 · CVE-2021-37631

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.5.1 Nextcloud Deck versions prior to 1.4.4 Nextcloud Deck versions prior to 1.2.9

Description The Deck application didn't properly check membership of users in a Circle. This allowed other users in the instance to gain access to boards that have been shared with a Circle, even if the user was not a member of the circle.

Recommendations For versions prior to 1.5.1, upgrade to 1.5.1. For versions prior to 1.4.4, upgrade to 1.4.4. For versions prior to 1.2.9, upgrade to 1.2.9. If you are unable to update, disable the Deck plugin.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2021-37631

GHSA-4MXP-J277-82HR

Affected Products

Nextcloud Deck

References · 7

• https://github.com/nextcloud/deck/pull/3217 · Patch
• https://osv.dev/vulnerability/CVE-2021-37631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37631 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mxp-j277-82hr · Note
• https://hackerone.com/reports/1256021 · Note
• https://hackerone.com/reports/1280931 · Note
• https://t.me/cibsecurity/28396 · Telegram Post