sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2021-32657 Malicious user could break user administration page

Medium 4.3 Published Updated

A malicious user can disrupt the user administration page, preventing administrators from managing users on the Nextcloud instance.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2021-32657?

CVE-2021-32657 is a medium-severity denial of service vulnerability in Nextcloud Nextcloud Server, published on 1 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. The vulnerability is fixed in versions 19.0.11, 20.0.10, and 21.0.2. As a workaround, administrators can use the OCC command line tool to administrate the Nextcloud users.

Weakness: CWE-400

Which versions are affected by CVE-2021-32657?

It affects 1 product.

Products include Nextcloud Nextcloud Server.

How do I fix CVE-2021-32657?

No fix has been published for CVE-2021-32657 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-32657 being exploited?

There is no known exploitation of CVE-2021-32657 in the wild and no public exploit code.

All Nextcloud Nextcloud Server vulnerabilities

Sources

Also known as GHSA-fx62-q47f-f665.

Is CVE-2021-32657 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free