CVE-2021-22895

nextcloud-desktop - security update

5.9 MediumFix available

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

1.04%Unchanged since Jun 12, 2021

What each source reports

NVD Score used 5.9

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.

Record: CVE-2021-22895
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-295
Updated: 2026-11-02

CVE List No score

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.

Record: CVE-2021-22895
Weakness: CWE-295
Updated: 2026-11-02

EUVDEUVD-2021-10027 No score

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.

Record: EUVD-2021-10027
Updated: 2026-11-03

OSV 5.9

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.

Record: CVE-2021-22895
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-22895 5.9

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.

Record: DEBIAN-CVE-2021-22895
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-22895 5.9

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.

Record: UBUNTU-CVE-2021-22895
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVMGASA-2021-0421 No score

Updated nextcloud-client packages fix security vulnerability

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow. (CVE-2021-22895)

In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to previously downloaded public certificate. If the Nextcloud instance serves a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. This issue is fixed in Nextcloud Desktop Client version 3.3.0

Record: MGASA-2021-0421
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`nextcloud-desktop` Debian:12	before 3.3.1-1	3.3.1-1
`nextcloud-desktop` Debian:13	before 3.3.1-1	3.3.1-1
`nextcloud-desktop` Debian:14	before 3.3.1-1	3.3.1-1
`nextcloud-desktop` Debian:10	before 2.5.1-3+deb10u2, plus listed versions 2.5.1-32.5.1-3+deb10u1	2.5.1-3+deb10u2
`nextcloud-desktop` Debian:11	before 3.1.1-2+deb11u1, plus listed versions 3.1.1-2	3.1.1-2+deb11u1
`nextcloud-client` Mageia:8	before 3.3.3-1.mga8	3.3.3-1.mga8
`nextcloud-desktop` Ubuntu:20.04:LTS	All versions, plus listed versions 2.5.3-12.6.0-12.6.1-12.6.1-22.6.2-12.6.2-1build1	None known
`nextcloud-desktop` Ubuntu:22.04:LTS	All versions, plus listed versions 3.2.3-0ubuntu13.3.5-13.3.5-1ubuntu13.4.2-13.4.2-1ubuntu1	None known
`nextcloud-desktop` Ubuntu:24.04:LTS	All versions, plus listed versions 3.9.0-13.10.0-13.11.0-13.11.0-1.1build33.11.0-1.1build4	None known
`nextcloud-desktop` Ubuntu:25.10	All versions, plus listed versions 3.16.0-13.16.2-13.16.4-13.16.6-13.16.6-3	None known
`nextcloud-desktop` Ubuntu:26.10	All versions, plus listed versions 4.0.6-133.0.2-133.0.7-1ubuntu1	None known
`nextcloud-desktop` Ubuntu:26.04:LTS	All versions, plus listed versions 3.16.6-33.16.7-14.0.1-24.0.1-2build14.0.6-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-22895 is a medium vulnerability (CVSS 5.9) in Nextcloud Desktop, published June 11, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.04%, the 64th percentile. Fixed in nextcloud-desktop 3.3.1-1.

References

Show 6 moreShow less