CVE-2021-32688

Katalog CVE

CVSS 8.8 · High EPSS 2,3%

Kerentanan Improper Authorization pada nextcloud server, fedoraproject fedora. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds aside from upgrading.

Rincian

Terbit di NVD

12 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization
CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/server/pull/27000 patch · advisory pihak ketiga
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-48m7-7r2r-838r advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-17 advisory pihak ketiga
• https://hackerone.com/reports/1193321 permissions required
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DY...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCA...