CVE-2021-22895: 
Nextcloud Desktop Client vulnerability analysis and mitigation

Nextcloud Desktop Client before version 3.3.1 was found to be vulnerable to improper certificate validation (CVE-2021-22895). The vulnerability specifically affects the "Register with a Provider" flow where SSL certificate verification was not properly implemented. This security issue was discovered in early 2021 and was addressed in version 3.3.1 of the software (NVD, Security Advisory).

The vulnerability is classified as CWE-295 (Improper Certificate Validation) with a CVSS v3.1 Base Score of 5.9 (Medium). The CVSS vector string is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating that the vulnerability is network exploitable, requires high attack complexity, needs no privileges, requires no user interaction, has unchanged scope, and can result in high impact to integrity but no impact to confidentiality or availability (NVD).

The vulnerability could allow an attacker to perform man-in-the-middle attacks during the provider registration process due to the lack of SSL certificate verification. This could potentially lead to the interception of sensitive information exchanged during the registration flow (Security Advisory).

The vulnerability requires network access and high attack complexity to exploit. While the vulnerability has been publicly disclosed, there are no known reports of this vulnerability being exploited in the wild (NVD).

The recommended mitigation is to upgrade the Nextcloud Desktop Client to version 3.3.1 or later. No alternative workarounds are available for this vulnerability. The fix was also backported to version 3.1.3 for users on the 3.1.x branch (Security Advisory, Release Notes).