Arbitrary Code Injection Affecting nextcloud-desktop package, versions <3.1.1-2
Threat Intelligence
EPSS
1.78% (89th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-NEXTCLOUDDESKTOP-1247789
- published 16 Apr 2021
- disclosed 14 Apr 2021
Introduced: 14 Apr 2021
CVE-2021-22879 Open this link in a new tabHow to fix?
Upgrade Debian:11 nextcloud-desktop to version 3.1.1-2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream nextcloud-desktop package and not the nextcloud-desktop package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.
References
- https://security-tracker.debian.org/tracker/CVE-2021-22879
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTWBJAS5DJJIK7LLVBZZQTSJASUVIRVE/
- https://security.gentoo.org/glsa/202105-37
- https://github.com/nextcloud/desktop/pull/2906
- https://hackerone.com/reports/1078002
- https://nextcloud.com/security/advisory/?id=NC-SA-2021-008
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTWBJAS5DJJIK7LLVBZZQTSJASUVIRVE/
CVSS Scores
version 3.1