CVE-2021-32726
Summary
| CVE | CVE-2021-32726 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-07-12 20:15:00 UTC |
|---|
| Updated | 2022-10-25 15:33:00 UTC |
|---|
| Description | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Nextcloud: Multiple Vulnerabilities (GLSA 202208-17) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| HackerOne |
MISC |
hackerone.com |
|
| Properly cleanup entries of WebAuthn on user deletion by MorrisJobke · Pull Request #27532 · nextcloud/server · GitHub |
MISC |
github.com |
|
| Webauthn tokens not removed after user has been deleted · Advisory · nextcloud/security-advisories · GitHub |
CONFIRM |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 710590 Gentoo Linux Nextcloud Multiple Vulnerabilities (GLSA 202208-17)
- 750849 OpenSUSE Security Update for nextcloud (openSUSE-SU-2021:1068-1)
- 750850 OpenSUSE Security Update for nextcloud (openSUSE-SU-2021:1068-1)
