PT-2021-22476 · Nextcloud · Nextcloud Deck

Lukas Reschke · Published 2021-10-25 · Updated 2022-04-25 · CVE-2021-39225

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.2.9 Nextcloud Deck versions prior to 1.4.5 Nextcloud Deck versions prior to 1.5.3

Description A missing permission check in Nextcloud Deck allows another authenticated user to access Deck cards of another user.

Recommendations For Nextcloud Deck versions prior to 1.2.9, upgrade to version 1.2.9. For Nextcloud Deck versions prior to 1.4.5, upgrade to version 1.4.5. For Nextcloud Deck versions prior to 1.5.3, upgrade to version 1.5.3.

Fix

Missing Authorization

IDOR

Weakness Enumeration

CWE-862

CWE-639

Related Identifiers

CVE-2021-39225

GHSA-2X96-38QG-3M72

Affected Products

Nextcloud Deck

References · 8

• https://github.com/nextcloud/deck/pull/3316 · Patch
• https://osv.dev/vulnerability/CVE-2021-39225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39225 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2x96-38qg-3m72 · Note
• https://hackerone.com/reports/1331728 · Note
• https://t.me/cibsecurity/31185 · Telegram Post
• https://t.me/cvenotify/22396 · Telegram Post
• https://t.me/cvenotify/22639 · Telegram Post