CVE-2021-32688
Published: 12 July 2021
Summary
CVE-2021-32688 is a high-severity Improper Authorization (CWE-285) vulnerability in Nextcloud Nextcloud Server. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 12.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-19492
Vulnerability details
Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by…
more
the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds aside from upgrading.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Authorization checks via training and content reviews ensure only approved information is released to public systems.
Documenting access to processing and storage locations helps ensure correct authorization for information resources.
Requiring explicit approval for maintenance activities and component removal enforces proper authorization for critical system operations.
Procedures enforce authorization rules for media handling, making unauthorized actions harder to perform without detection.
Limiting media access to authorized parties addresses improper authorization for resource access.
The control requires authorization mechanisms and senior approval to prevent unauthorized viewing or alteration of the plan.
Mandates authorization checks so public access cannot perform disallowed operations or modifications.
Decoys identify and block exploitation of improper authorization by providing monitored targets that mimic protected functions.