medium5.9
CVE-2021-22895
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register wit…
Impact
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nextcloud | Desktop | before 3.1.3 |
| Debian | Debian Linux | Versions 10.0, 11.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/nextcloud/desktop/pull/2926
- https://github.com/nextcloud/desktop/releases/tag/v3.1.3
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qpgp-vf4p-wcw5
- https://hackerone.com/reports/903424
- https://www.debian.org/security/2021/dsa-4974
- https://github.com/nextcloud/desktop/pull/2926
- https://github.com/nextcloud/desktop/releases/tag/v3.1.3
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qpgp-vf4p-wcw5
- https://hackerone.com/reports/903424
- https://www.debian.org/security/2021/dsa-4974