CVE-2021-32726

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:07

Type Values Removed Values Added
References () https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6qr9-c846-j8mg - Third Party Advisory () https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6qr9-c846-j8mg - Third Party Advisory
References () https://github.com/nextcloud/server/pull/27532 - Third Party Advisory () https://github.com/nextcloud/server/pull/27532 - Third Party Advisory
References () https://hackerone.com/reports/1202590 - Permissions Required () https://hackerone.com/reports/1202590 - Permissions Required
References () https://security.gentoo.org/glsa/202208-17 - Third Party Advisory () https://security.gentoo.org/glsa/202208-17 - Third Party Advisory
CVSS v2 : 7.5
v3 : 9.8
v2 : 7.5
v3 : 7.1

Information

Published : 2021-07-12 20:15

Updated : 2024-11-21 06:07


NVD link : CVE-2021-32726

Mitre link : CVE-2021-32726

CVE.ORG link : CVE-2021-32726


JSON object : View

Products Affected

nextcloud

  • nextcloud_server
CWE
CWE-708

Incorrect Ownership Assignment

CWE-287

Improper Authentication