CVE-2021-32728

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to previously downloaded public certificate. If the Nextcloud instance serves a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. This issue is fixed in Nextcloud Desktop Client version 3.3.0. There are no known workarounds aside from upgrading.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Aug 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327295.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions CVE-2021-32737.2Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someon CVE-2021-327305.7XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulner CVE-2021-327315.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13 CVE-2021-327326.5### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually ti CVE-2021-327336.1Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versio CVE-2021-327345.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text appl CVE-2021-327355.4Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files s CVE-2021-327367.5think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an CVE-2021-327374.8Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for CVE-2021-327386.5js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 CVE-2021-327398.8Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data