Vulnerability · Published Jun 14, 2024 · Assigned by GitHub_M

CVE-2024-37313Nextcloud server allows the by-pass the second factor

High 7.3

In plain English

A high-severity improper authentication in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>= 26.0.0, < 26.0.13>= 27.0.0, < 27.1.8>= 28.0.0, < 28.0.4

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9v72-9xv5-3p7c x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/44276 x_refsource_MISC
https://hackerone.com/reports/2419776 x_refsource_MISC