CVE-2021-32654: Attacker can obtain write access to any federated share/public link
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32654?
CVE-2021-32654 is classified as a moderate severity vulnerability due to the potential unauthorized access to Federated File Shares.
How do I fix CVE-2021-32654?
To fix CVE-2021-32654, upgrade your Nextcloud Server to version 19.0.11, 20.0.10, or 21.0.2 or later.
What versions of Nextcloud are affected by CVE-2021-32654?
CVE-2021-32654 affects Nextcloud Server versions prior to 19.0.11, 20.0.10, and 21.0.2.
What is the impact of CVE-2021-32654?
The impact of CVE-2021-32654 allows attackers to gain unauthorized read/write access to Federated File Shares.
Am I at risk if I use Nextcloud versions before 19.0.11, 20.0.10, or 21.0.2?
Yes, using Nextcloud versions before 19.0.11, 20.0.10, or 21.0.2 poses a risk due to the vulnerability in CVE-2021-32654.