CVE-2021-39225
A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3. There are no known workarounds aside from upgrading.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 1.34% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-639, CWE-862
- Affected
- nextcloud/deck
- Source
- security-advisories@github.com
References
- https://github.com/nextcloud/deck/pull/3316Patch, Third Party Advisory
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2x96-38qg-3m72Third Party Advisory
- https://hackerone.com/reports/1331728Permissions Required, Third Party Advisory
- https://github.com/nextcloud/deck/pull/3316Patch, Third Party Advisory
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2x96-38qg-3m72Third Party Advisory
- https://hackerone.com/reports/1331728Permissions Required, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.