CVE-2021-32728 — Improper Certificate Validation in Security-advisories

CWE-295 — Improper Certificate Validation4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 56.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Nextcloud Security-advisoriesNextcloud DesktopDebian Linux
Timeline
PublishedAug 18

Description

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to previously downloaded public certificate. If the Nextcloud instance serves a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious ac…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDnextcloud/desktop< 3.3.0

Also affects: Debian Linux 10.0, 11.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
CVE-2021-32728: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer↗2021-08-18
▶
CVEList
End-to-end encryption device setup did not verify public key↗2021-08-18
▶

📋Vendor Advisories

1
Debian
CVE-2021-32728: nextcloud-desktop - The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Serve...↗2021
▶
CVE-2021-32728 — Improper Certificate Validation | cvebase