CVE-2021-37630
published 2021-09-07CVE-2021-37630: Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user…
PriorityP434medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.16%
63.3th percentile
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is recommended that Nextcloud Circles is upgraded to 0.19.15, 0.20.11 or 0.21.4. There are no workarounds for this issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nextcloud | circles | < 0.19.5 | 0.19.5 |
| nextcloud | circles | >= 0.20.0 < 0.20.11 | 0.20.11 |
| nextcloud | circles | >= 0.21.0 < 0.21.4 | 0.21.4 |
| nextcloud | security-advisories | < 0.19.15 | 0.19.15 |
| nextcloud | security-advisories | — | — |
| nextcloud | security-advisories | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/nextcloud/circles/pull/768https://github.com/nextcloud/security-advisories/security/advisories/GHSA-56j9-3rj4-wvgmhttps://hackerone.com/reports/1257624https://github.com/nextcloud/circles/pull/768https://github.com/nextcloud/security-advisories/security/advisories/GHSA-56j9-3rj4-wvgmhttps://hackerone.com/reports/1257624
2021-09-07
Published