PT-2022-11378 · Nextcloud+1 · Nextcloud Server+1

Carl Schwann + 1 · Published 2022-03-08 · Updated 2022-10-25 · CVE-2021-41241

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 20.0.14 Nextcloud Server versions prior to 21.0.6 Nextcloud Server versions prior to 22.2.1

Description The Nextcloud server is a self-hosted system designed to provide cloud-style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people and setting advanced permissions on subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location.

Recommendations For versions prior to 20.0.14, upgrade to 20.0.14. For versions prior to 21.0.6, upgrade to 21.0.6. For versions prior to 22.2.1, upgrade to 22.2.1. Users unable to upgrade should disable the groupfolders application in the admin settings.

Fix

Missing Authorization

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-863

Related Identifiers

ALT-PU-2022-2504

ALT-PU-2022-2555

CVE-2021-41241

GHSA-M4WP-R357-4Q94

OPENSUSE-SU-2022:0089-1

OPENSUSE-SU-2022:0098-1

Affected Products

Alt Linux

Nextcloud Server

References · 19

• https://github.com/nextcloud/server/pull/29362 · Patch
• https://github.com/nextcloud/groupfolders/issues/1692 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:0098-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0089-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41241 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41241 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m4wp-r357-4q94 · Note
• https://suse.com/security/cve/CVE-2021-41239 · Note
• https://t.me/cvenotify/34397 · Telegram Post
• https://bugzilla.suse.com/1196908 · Note
• https://t.me/cvenotify/27931 · Telegram Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/EZTHEQMMIKP2RX3EBMXDQAOIVUPMCDFB · Note
• https://suse.com/security/cve/CVE-2021-41741 · Note
• https://t.me/cibsecurity/38555 · Telegram Post