CVE-2021-32801

published 2021-09-07

CVE-2021-32801: Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive…

Priority P4 24 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C H I N A N

Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are advised to disable system logging to resolve this issue until such time that an upgrade can be performed Note that ff you do not use the Encryption-at-Rest functionality of Nextcloud you are not affected by this bug.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
nextcloud	nextcloud_server	< 20.0.12	20.0.12
nextcloud	nextcloud_server	>= 21.0.0 < 21.0.4	21.0.4
nextcloud	nextcloud_server	>= 22.0.0 < 22.1.0	22.1.0
nextcloud	security-advisories	< 20.0.12	20.0.12
nextcloud	security-advisories	—	—
nextcloud	security-advisories	—	—

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 2.1 LOW AV:L/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-532