Description
Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functionality wasn't properly logging events for the unsetting of a share expiration date. This event is supposed to be logged. This issue is patched in versions 19.0.13, 20.0.11, and 21.0.3.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nextcloud security-advisories
< 19.0.13affected>= 20.0.0, < 20.0.11affected>= 21.0.0, < 21.0.3affected
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fxpq-wq7c-vppf ↗
- https://github.com/nextcloud/server/pull/27024 ↗
- https://hackerone.com/reports/1200810 ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/ ↗
- https://security.gentoo.org/glsa/202208-17 ↗