CVE-2021-32655
Files Drop public link can be added as federated share
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and tries to remove the "Create" privileges of this unexpected share, Nextcloud server would silently grant the share read privileges. The vulnerability is patched in versions 19.0.11, 20.0.10 and 21.0.2. No workarounds are known to exist.
Nextcloud Server es un paquete de Nextcloud que maneja el almacenamiento de datos. En versiones anteriores a 19.0.11, 20.0.10 y 21.0.2, un atacante es capaz de convertir un enlace de Drop de archivos en un recurso compartido federado. Esto causa un problema en el lado de la Interfaz de Usuario del usuario que comparte. Cuando el usuario que comparte abre el panel para compartir y trata de eliminar los privilegios "Create" de este recurso compartido inesperado, el servidor de Nextcloud concede silenciosamente al recurso compartido privilegios de lectura. La vulnerabilidad está parcheada en versiones 19.0.11, 20.0.10 y 21.0.2. No se sabe que existan soluciones alternativas
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-05-12 CVE Reserved
- 2021-06-01 CVE Published
- 2023-04-18 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-241: Improper Handling of Unexpected Data Type
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-grph-cm44-p3jv | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://security.gentoo.org/glsa/202208-17 | 2022-10-26 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Nextcloud Search vendor "Nextcloud" | Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server" | < 19.0.11 Search vendor "Nextcloud" for product "Nextcloud Server" and version " < 19.0.11" | - |
Affected
| ||||||
Nextcloud Search vendor "Nextcloud" | Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server" | >= 20.0.0 < 20.0.10 Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 20.0.0 < 20.0.10" | - |
Affected
| ||||||
Nextcloud Search vendor "Nextcloud" | Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server" | >= 21.0.0 < 21.0.2 Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 21.0.0 < 21.0.2" | - |
Affected
|