CVE-2021-32676

Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended that the Nextcloud Talk App is upgraded to 9.0.10, 10.0.8 or 11.2.2. No workarounds for this vulnerability are known to exist.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p6h7-84v4-827r	Third Party Advisory
https://hackerone.com/reports/1181962	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nextcloud:talk::::::::
	cpe:2.3:a:nextcloud:talk::::::::
	cpe:2.3:a:nextcloud:talk::::::::

History

23 Jun 2021, 20:05

Type	Values Removed	Values Added
CPE		cpe:2.3:a:nextcloud:talk::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 4.0 v3 : 6.5
CWE		CWE-384
References	~~(MISC) https://hackerone.com/reports/1181962 -~~	(MISC) https://hackerone.com/reports/1181962 - Issue Tracking, Third Party Advisory
References	~~(CONFIRM) https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p6h7-84v4-827r -~~	(CONFIRM) https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p6h7-84v4-827r - Third Party Advisory

16 Jun 2021, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-06-16 00:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-32676

Mitre link : CVE-2021-32676

CVE.ORG link : CVE-2021-32676

JSON object : View

Products Affected

nextcloud

talk

CWE

CWE-384

Session Fixation

{"id": "CVE-2021-32676", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-06-16T00:15:07.793", "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p6h7-84v4-827r", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/1181962", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended that the Nextcloud Talk App is upgraded to 9.0.10, 10.0.8 or 11.2.2. No workarounds for this vulnerability are known to exist."}, {"lang": "es", "value": "Nextcloud Talk es un servicio de comunicaci\u00f3n de audio/v\u00eddeo y chat totalmente local. Los chats compartidos protegidos por contrase\u00f1a en Talk versiones anteriores a 9.0.10, 10.0.8 y 11.2.2 no rotaban la cookie de sesi\u00f3n despu\u00e9s de un evento de autenticaci\u00f3n con \u00e9xito. Es recomendado actualizar la aplicaci\u00f3n Nextcloud Talk a las versiones 9.0.10, 10.0.8 o 11.2.2. No se conocen soluciones para esta vulnerabilidad"}], "lastModified": "2021-06-23T20:05:17.513", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "794C80ED-02EE-4EDD-B326-51EDD12BB050", "versionEndExcluding": "9.0.10"}, {"criteria": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "663A8BD2-00AF-4976-B333-EA830B38A5B6", "versionEndExcluding": "10.0.8", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "890942A1-62F3-4FC4-AA0B-0B4EF2C5CE71", "versionEndExcluding": "11.2.2", "versionStartIncluding": "11.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}