PT-2021-15249 · Nextcloud+1 · Nextcloud+1
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Nextcloud versions prior to 20.0.6
Description
A missing user check in Nextcloud inadvertently populates a user's own credentials for other users' external storage configuration when not already configured yet.
Recommendations
For Nextcloud versions prior to 20.0.6, update to version 20.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to external storage configurations to minimize the risk of exploitation.
Exploit
Fix
Missing Authorization
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Nextcloud