CVE-2024-37313

2024-06-1415:15:51

CWE-287

[email protected]

web.nvd.nist.gov

nextcloud

self hosted

personal cloud

bypass

2fa

upgrade

security fix

nextcloud enterprise server

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

0.0004 Low

EPSS

Percentile

15.5%

JSON

Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4.

Affected configurations

Vulners

Node

nextcloudnextcloudRange26.0.0–26.0.13

nextcloudnextcloudRange27.0.0–27.1.8

nextcloudnextcloudRange28.0.0–28.0.4

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": ">= 26.0.0, < 26.0.13",
        "status": "affected"
      },
      {
        "version": ">= 27.0.0, < 27.1.8",
        "status": "affected"
      },
      {
        "version": ">= 28.0.0, < 28.0.4",
        "status": "affected"
      }
    ]
  }
]