Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-32653

Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup server even if the user has no fields set to published. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2; no workarounds outside the updates are known to exist.

Published

2021-06-01T20:15:08.517

Last Modified

2024-11-21T06:07:27.890

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 2.7 (LOW)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-201

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	nextcloud	nextcloud_server	< 19.0.11	Yes
Application	nextcloud	nextcloud_server	< 20.0.10	Yes
Application	nextcloud	nextcloud_server	< 21.0.2	Yes

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-396j-vqpr-qg45 Third Party Advisory ([email protected])
https://hackerone.com/reports/1173436 Permissions Required, Third Party Advisory ([email protected])
https://security.gentoo.org/glsa/202208-17 Third Party Advisory ([email protected])
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-396j-vqpr-qg45 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://hackerone.com/reports/1173436 Permissions Required, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202208-17 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)