CVE-2021-32802: Preview generation used third-party library not suited for user-generated content in Nextcloud server
First published: Tue Sep 07 2021(Updated: )
Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several security concerns with passing user-generated content to this library, such as Server-Side-Request-Forgery, file disclosure or potentially executing code on the system. The risk depends on your system configuration and the installed library version. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. These versions do not use this library anymore. As a workaround users may disable previews by setting `enable_previews` to `false` in `config.php`.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Server | <20.0.12 | |
| Nextcloud Server | >=21.0.0<21.0.4 | |
| Nextcloud Server | >=22.0.0<22.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-32802?
CVE-2021-32802 is considered a medium-severity vulnerability due to potential security risks associated with untrusted user-supplied content.
How do I fix CVE-2021-32802?
To fix CVE-2021-32802, update your Nextcloud server to version 20.0.12 or later, or to versions between 21.0.0 and 21.0.4, or between 22.0.0 and 22.1.0.
What vulnerabilities are related to CVE-2021-32802?
CVE-2021-32802 may be related to vulnerabilities in third-party libraries used for processing image previews.
What is the impact of CVE-2021-32802 on Nextcloud users?
The impact of CVE-2021-32802 can potentially allow an attacker to execute arbitrary code through maliciously crafted image files.
Does CVE-2021-32802 affect all versions of Nextcloud?
CVE-2021-32802 affects multiple versions of Nextcloud Server prior to 20.0.12 and specific versions in the 21.x and 22.x ranges.
- agent/type
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/nextcloud
- canonical/nextcloud server
- version/nextcloud server/21.0.0
- version/nextcloud server/22.0.0