CVE-2021-22896

Опубликовано: 11 июн. 2021

Источник: nvd

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases for other users.

Ссылки

https://github.com/nextcloud/mail/pull/4864
Patch
Third Party Advisory
https://github.com/nextcloud/mail/releases/tag/v1.9.5
Release Notes
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jmgp-77jq-fjp3
Third Party Advisory
https://hackerone.com/reports/1129996
Third Party Advisory
https://github.com/nextcloud/mail/pull/4864
Patch
Third Party Advisory
https://github.com/nextcloud/mail/releases/tag/v1.9.5
Release Notes
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jmgp-77jq-fjp3
Third Party Advisory
https://hackerone.com/reports/1129996
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*

Версия до 1.9.5 (исключая)

EPSS

Процентиль: 61%

0.00409

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-862