CVE-2021-32676: Session Fixation in Nextcloud Talk
Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended that the Nextcloud Talk App is upgraded to 9.0.10, 10.0.8 or 11.2.2. No workarounds for this vulnerability are known to exist.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-32676?
CVE-2021-32676 is a vulnerability in Nextcloud Talk that allows password protected shared chats to not rotate the session cookie after a successful authentication event.
How does CVE-2021-32676 affect Nextcloud Talk?
CVE-2021-32676 affects Nextcloud Talk versions 9.0.10, 10.0.8, and 11.2.2.
What is the severity level of CVE-2021-32676?
The severity level of CVE-2021-32676 is medium.
How can I fix CVE-2021-32676 in Nextcloud Talk?
To fix CVE-2021-32676, it is recommended to upgrade the Nextcloud Talk App to version 9.0.10 or higher.
Where can I find more information about CVE-2021-32676?
For more information about CVE-2021-32676, you can refer to the following sources: [GitHub Security Advisory](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p6h7-84v4-827r) and [HackerOne report](https://hackerone.com/reports/1181962).