9.8
CVE-2021-32726
- EPSS 0.55%
- Published 12.07.2021 20:15:10
- Last modified 21.11.2024 06:07:36
- Source security-advisories@github.com
- Teams watchlist Login
- Open Login
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
Data is provided by the National Vulnerability Database (NVD)
Nextcloud ≫ Nextcloud Server Version < 19.0.13
Nextcloud ≫ Nextcloud Server Version >= 20.0.0 < 20.0.11
Nextcloud ≫ Nextcloud Server Version >= 21.0.0 < 21.0.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.55% | 0.67 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
| security-advisories@github.com | 7.1 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-708 Incorrect Ownership Assignment
The product assigns an owner to a resource, but the owner is outside of the intended control sphere.