CVE-2024-37313CWE-287

Nextcloud server allows the by-pass the second factor

High · published June 14, 2024

CVSS v3.1
7.3
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00402 · 33.3th percentile
Weakness
CWE-287 · Improper Authentication
Published
2024-06-14T14:50Z
EPSS history
Timeline
  • 14 JUN 14:50Z
    Nextcloud server allows the by-pass the second factor
    cvelistv5