8.1

CVE-2021-39225

Missing permission check on Deck API

Missing permission check on Deck API

Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3. There are no known workarounds aside from upgrading.
Mögliche Gegenmaßnahme
Deck: None.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Deck Version < 1.2.9
Nextcloud ≫ Deck Version >= 1.3.0 < 1.4.5
Nextcloud ≫ Deck Version >= 1.5.0 < 1.5.3
Weitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt Deck
Version >= 0.0.0, < 1.2.9
Version >= 1.4.0, < 1.4.5
Version >= 1.5.0, < 1.5.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.29% 0.665
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N
security-advisories@github.com 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/nextcloud/deck/pull/3316
Patch
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2x96-38qg-3m72
Third Party Advisory
https://hackerone.com/reports/1331728
Third Party Advisory
Permissions Required
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2x96-38qg-3m72
Third Party Advisory