CVE-2021-39225
25.10.2021, 22:15
Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3. There are no known workarounds aside from upgrading.Enginsight
| Vendor | Product | Version |
|---|---|---|
| nextcloud | deck | 𝑥 < 1.2.9 |
| nextcloud | deck | 1.3.0 ≤ 𝑥 < 1.4.5 |
| nextcloud | deck | 1.5.0 ≤ 𝑥 < 1.5.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-862 - Missing AuthorizationThe software does not perform an authorization check when an actor attempts to access a resource or perform an action.
References