CVE-2021-32657

Name

CVE-2021-32657

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. The vulnerability is fixed in versions 19.0.11, 20.0.10, and 21.0.2. As a workaround, administrators can use the OCC command line tool to administrate the Nextcloud users.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
MISC	https://hackerone.com/reports/1147611
CONFIRM	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fx62-q47f-f665

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:nextcloud:nextcloud_server::::::::`	nextcloud_server	>= None	< 19.0.11
`cpe:2.3:a:nextcloud:nextcloud_server::::::::`	nextcloud_server	>= 20.0.0	< 20.0.10
`cpe:2.3:a:nextcloud:nextcloud_server::::::::`	nextcloud_server	>= 21.0.0	< 21.0.2

References

Match rules

Vulnerable and fixed packages