← Back to CVEs

CVE-2021-32800

HIGH

8.1

Description

Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.

CVE Details

CVSS v3.1 Score8.1

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published9/7/2021

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

nextcloud:nextcloud_server

Weaknesses (CWE)

CWE-306CWE-306

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gv5w-8q25-785v(security-advisories@github.com)

https://github.com/nextcloud/server/pull/28078(security-advisories@github.com)

https://hackerone.com/reports/1271052(security-advisories@github.com)

https://security.gentoo.org/glsa/202208-17(security-advisories@github.com)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gv5w-8q25-785v(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/nextcloud/server/pull/28078(af854a3a-2127-422b-91ae-364da2661108)

https://hackerone.com/reports/1271052(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202208-17(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.