PT-2021-23154
CVE-2021-41179
·
تاريخ النشر
2021-10-25
·
تاريخ التحديث
2021-12-20
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Nextcloud Server versions prior to 20.0.13
Nextcloud Server versions prior to 21.0.5
Nextcloud Server versions prior to 22.2.0
Description
Nextcloud is an open-source, self-hosted productivity platform. The Two-Factor Authentication wasn't enforced for pages marked as
@PublicPage. This could be leveraged to gain access to any private chat channel without going through the Two-Factor flow, particularly affecting the Nextcloud Talk application.Recommendations
For versions prior to 20.0.13, upgrade to 20.0.13.
For versions prior to 21.0.5, upgrade to 21.0.5.
For versions prior to 22.2.0, upgrade to 22.2.0.
As a temporary workaround, consider restricting access to pages marked as
@PublicPage until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾