Skip to content

Possibility for anyone to add a stack with existing tasks on anyone's board in the Deck app

Moderate
nickvergessen published GHSA-vqhf-673w-7r3j May 20, 2022

Package

Deck (Nextcloud)

Affected versions

< 1.4.8, < 1.5.6, < 1.6.1

Patched versions

1.4.8, 1.5.6, 1.6.1

Description

Impact

An authenticated user can move stacks with cards from their own board to a board of another user.

Patches

It is recommended that the Nextcloud Deck app is upgraded to 1.4.8, 1.5.6 or 1.6.1.

Workarounds

No workaround available

References

For more information

If you have any questions or comments about this advisory:

Severity

Moderate
5.0
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

CVE ID

CVE-2022-29159

Weaknesses