CVE-2021-32800CWE-306

Bypass of Two Factor Authentication in Nextcloud server

High · published September 7, 2021

CVSS v3.1
8.1
EPSS
2%
Percentile
78.3
In the wild
Unconfirmed
What it is

Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01798 · 78.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2021-09-07T21:35Z
EPSS history
Timeline
  • 07 SEP 21:35Z
    Bypass of Two Factor Authentication in Nextcloud server
    cvelistv5