CVE-2021-32801 : Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resu

Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are advised to disable system logging to resolve this issue until such time that an upgrade can be performed Note that ff you do not use the Encryption-at-Rest functionality of Nextcloud you are not affected by this bug.

Published 2021-09-07 22:15:08

Updated 2022-09-27 14:18:05

Source GitHub, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-32801

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 12 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-32801

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	GitHub, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2021-32801

CWE-532 Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Assigned by:

nvd@nist.gov (Secondary)
security-advisories@github.com (Primary)

References for CVE-2021-32801

https://github.com/nextcloud/server/pull/28082

Sanitize more functions from the encryption app by LukasReschke · Pull Request #28082 · nextcloud/server · GitHub
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mcpf-v65v-359h

Exceptions may have logged Encryption-at-Rest key content · Advisory · nextcloud/security-advisories · GitHub
Third Party Advisory
https://security.gentoo.org/glsa/202208-17

Nextcloud: Multiple Vulnerabilities (GLSA 202208-17) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://hackerone.com/reports/1251776

Sign in
Permissions Required;Third Party Advisory

Products affected by CVE-2021-32801

Nextcloud » Nextcloud Server
Versions from including (>=) 22.0.0 and before (<) 22.1.0
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Matching versions
Nextcloud » Nextcloud Server
Versions before (<) 20.0.12
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Matching versions
Nextcloud » Nextcloud Server
Versions from including (>=) 21.0.0 and before (<) 21.0.4
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2021-32801

Exploit prediction scoring system (EPSS) score for CVE-2021-32801

CVSS scores for CVE-2021-32801

CWE ids for CVE-2021-32801

References for CVE-2021-32801

Products affected by CVE-2021-32801