CVE-2021-32688

Application specific tokens can change their own scope

State: Published
Severity: 8.8 High
Published: Jul 12, 2021
Updated: Aug 3, 2024
Reserved: May 12, 2021

Description

Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds aside from upgrading.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
security-advisoriesnextcloud	< 19.0.13Affected >= 20.0.0, < 20.0.11Affected >= 21.0.0, < 21.0.3Affected

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-48m7-7r2r-838r
https://github.com/nextcloud/server/pull/27000
https://hackerone.com/reports/1193321
FEDORA-2021-9b421b78afvendor-advisory
FEDORA-2021-6f327296fevendor-advisory
GLSA-202208-17vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.