CVE-2021-32680

Audit log is not properly logging unsetting of share expiration date

State: Published
Severity: 3.3 Low
Published: Jul 12, 2021
Updated: Aug 3, 2024
Reserved: May 12, 2021

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functionality wasn't properly logging events for the unsetting of a share expiration date. This event is supposed to be logged. This issue is patched in versions 19.0.13, 20.0.11, and 21.0.3.

Scores

CVSS	Score	Vector	Source
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	GitHub_M

Weaknesses

CWE-778 Insufficient Logging

Affected Products

Product	Versions
security-advisoriesnextcloud	< 19.0.13Affected >= 20.0.0, < 20.0.11Affected >= 21.0.0, < 21.0.3Affected

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fxpq-wq7c-vppf
https://github.com/nextcloud/server/pull/27024
https://hackerone.com/reports/1200810
FEDORA-2021-9b421b78afvendor-advisory
FEDORA-2021-6f327296fevendor-advisory
GLSA-202208-17vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.