SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-32726

Nextcloud Server is a Nextcloud package that handles data storage.

CRITICAL 9.8EPSS 1.78%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.78%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.78% probability · 77th percentile
CISA KEV
Not listed
Weakness
CWE-708, CWE-287
Affected
nextcloud/nextcloud server
Source
security-advisories@github.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.