NVD Vulnerability Detail

CVE-2021-32680

Summary	Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functionality wasn't properly logging events for the unsetting of a share expiration date. This event is supposed to be logged. This issue is patched in versions 19.0.13, 20.0.11, and 21.0.3.
Publication Date	July 12, 2021, 11:15 p.m.
Registration Date	July 13, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:07 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:nextcloud:nextcloud_server::::::::	21.0.0			21.0.3
cpe:2.3:a:nextcloud:nextcloud_server::::::::	20.0.0			20.0.11
cpe:2.3:a:nextcloud:nextcloud_server::::::::				19.0.13

Related information, measures and tools

No	URL	タグ
1	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fxpq-wq7c-vppf	Third Party Advisory
2	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fxpq-wq7c-vppf	Third Party Advisory
3	https://github.com/nextcloud/server/pull/27024	Patch Third Party Advisory
4	https://github.com/nextcloud/server/pull/27024	Patch Third Party Advisory
5	https://hackerone.com/reports/1200810	Permissions Required
6	https://hackerone.com/reports/1200810	Permissions Required
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
11	https://security.gentoo.org/glsa/202208-17	Third Party Advisory
12	https://security.gentoo.org/glsa/202208-17	Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Nextcloud Server における脆弱性

Title	Nextcloud Server における脆弱性
Summary	Nextcloud Server には、不特定の脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 19, 2021, midnight
Registration Date	April 22, 2022, 6:08 p.m.
Last Update	April 22, 2022, 6:08 p.m.

Affected System

Fedora Project

Fedora

Nextcloud

Nextcloud Server 19.0.13 未満

Nextcloud Server 20.0.11 未満

Nextcloud Server 21.0.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-32680	https://www.cve.org/CVERecord?id=CVE-2021-32680
National Vulnerability Database (NVD)
2	CVE-2021-32680	https://nvd.nist.gov/vuln/detail/CVE-2021-32680

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
Fedora Update Notification
1	FEDORA-2021-6f327296fe	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/
2	FEDORA-2021-9b421b78af	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/
GitHub
3	Audit log is not properly logging unsetting of share expiration date	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fxpq-wq7c-vppf
4	Properly log expiration date removal in audit log #27024	https://github.com/nextcloud/server/pull/27024

Change Log

No	Changed Details	Date of change
1	[2022年04月13日] 掲載	April 13, 2022, 11:57 a.m.