NVD Vulnerability Detail

CVE-2021-37631

Summary	Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't properly check membership of users in a Circle. This allowed other users in the instance to gain access to boards that have been shared with a Circle, even if the user was not a member of the circle. It is recommended that Nextcloud Deck is upgraded to 1.5.1, 1.4.4 or 1.2.9. If you are unable to update it is advised to disable the Deck plugin.
Publication Date	Sept. 8, 2021, 5:15 a.m.
Registration Date	Sept. 8, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:15 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://github.com/nextcloud/deck/pull/3217	Patch Third Party Advisory
2	https://github.com/nextcloud/deck/pull/3217	Patch Third Party Advisory
3	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mxp-j277-82hr	Third Party Advisory
4	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mxp-j277-82hr	Third Party Advisory
5	https://hackerone.com/reports/1256021	Permissions Required Third Party Advisory
6	https://hackerone.com/reports/1256021	Permissions Required Third Party Advisory
7	https://hackerone.com/reports/1280931	Permissions Required Third Party Advisory
8	https://hackerone.com/reports/1280931	Permissions Required Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-639	ユーザ制御の鍵による認証回避	https://cwe.mitre.org/data/definitions/639.html

JVN Vulnerability Information

Nextcloud Deck におけるユーザ制御の鍵による認証回避に関する脆弱性

Title	Nextcloud Deck におけるユーザ制御の鍵による認証回避に関する脆弱性
Summary	Nextcloud Deck には、ユーザ制御の鍵による認証回避に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 6, 2021, midnight
Registration Date	June 29, 2022, 2:49 p.m.
Last Update	June 29, 2022, 2:49 p.m.

Affected System

Nextcloud

Nextcloud Deck 1.2.9 未満

Nextcloud Deck 1.4.4 未満

Nextcloud Deck 1.5.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-37631	https://www.cve.org/CVERecord?id=CVE-2021-37631
National Vulnerability Database (NVD)
2	CVE-2021-37631	https://nvd.nist.gov/vuln/detail/CVE-2021-37631

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-639	https://cwe.mitre.org/data/definitions/639.html

ベンダー情報

No	Name	URL
GitHub
1	Deck shared with a Circle can be accessed by non-Circle members	https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mxp-j277-82hr
2	Move circle checks to a unified service and improve member checks #3217	https://github.com/nextcloud/deck/pull/3217

Change Log

No	Changed Details	Date of change
1	[2022年06月29日] 掲載	June 29, 2022, 2:49 p.m.