CVE-2021-32680 LOW

CVE-2021-32680: Audit log is not properly logging unsetting of share expiration date

Vendor Nextcloud
Product security-advisories
Weakness CWE-778
Published July 12, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

3.3/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functionality wasn't properly logging events for the unsetting of a share expiration date. This event is supposed to be logged. This issue is patched in versions 19.0.13, 20.0.11, and 21.0.3.

Key dates

02Disclosure timeline

July 12, 2021 CVE published
August 3, 2024 Record updated