CVE-2021-32656 Information

Description

Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11 20.0.10 and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added as a federated share. This happens because Nextcloud supports sharing registered users with other Nextcloud servers which can be done automatically when selecting the \Add server automatically once a federated share was created successfully\ setting. The vulnerability is patched in versions 19.0.11 20.0.10 and 21.0.2 As a workaround disable \Add server automatically once a federated share was created successfully\ in the Nextcloud settings.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Reference

https://hackerone.com/reports/1167853 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j875-vr2q-h6x6

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

CHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

8.6