CVE-2021-39225 — Authorization Bypass Through User-Controlled Key in Security-advisories

CWE-639 — Authorization Bypass Through User-Controlled KeyCWE-862 — Missing Authorization2 documents2 sources
Severity
8.1HIGHNVD
EPSS
0.4%
top 41.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nextcloud Security-advisoriesNextcloud Deck
Timeline
PublishedOct 25

Description

Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3. There are no known workarounds aside from upgrading.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶NVDnextcloud/deck1.3.0 — 1.4.5+2
▶CVEListV5nextcloud/security-advisories< 1.2.9+2

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
CVEList
Missing permission check on Deck API↗2021-10-25
▶
CVE-2021-39225 — Security-advisories vulnerability | cvebase