CVE-2021-37631

Katalog CVE

CVSS 6.5 · Medium EPSS 1,3%

Kerentanan Authorization Bypass Through User-Controlled Key pada nextcloud deck. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't properly check membership of users in a Circle. This allowed other users in the instance to gain access to boards that have been shared with a Circle, even if the user was not a member of the circle. It is recommended that Nextcloud Deck is upgraded to 1.5.1, 1.4.4 or 1.2.9. If you are unable to update it is advised to disable the Deck plugin.

Rincian

Terbit di NVD

7 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/deck/pull/3217 patch · advisory pihak ketiga
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mxp-j277-82hr advisory pihak ketiga
• https://hackerone.com/reports/1256021 permissions required · advisory pihak ketiga
• https://hackerone.com/reports/1280931 permissions required · advisory pihak ketiga