9.1
CVE-2021-32654
- EPSS 0.28%
- Veröffentlicht 01.06.2021 21:15:07
- Zuletzt bearbeitet 21.11.2024 06:07:28
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
Attacker can obtain write access to any federated share/public link
Attacker can obtain write access to any federated share/public link
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing.
Mögliche Gegenmaßnahme
Nextcloud Server: Disable Federated File Sharing.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Nextcloud Server Version < 19.0.11
Nextcloud ≫ Nextcloud Server Version >= 20.0.0 < 20.0.10
Nextcloud ≫ Nextcloud Server Version >= 21.0.0 < 21.0.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
LoginWeitere Schwachstelleninformationen
SystemNextcloud
≫
Produkt
Nextcloud Server
Version
>= 0.0.0, < 19.0.11
Version
>= 20.0.0, < 20.0.10
Version
>= 21.0.0, < 21.0.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.28% | 0.505 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.1 | 3.9 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
|
| nvd@nist.gov | 6.4 | 10 | 4.9 |
AV:N/AC:L/Au:N/C:P/I:P/A:N
|
| security-advisories@github.com | 8.1 | 2.2 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-639 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.