Unrated severityNVD Advisory· Published Sep 7, 2021· Updated Aug 3, 2024
Bypass of Two Factor Authentication in Nextcloud server
CVE-2021-32800
Description
Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
8- Range: <20.0.12 || >=21.0.0 <21.0.4 || >=22.0.0 <22.1.0
- osv-coords6 versionspkg:rpm/opensuse/nextcloud&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/nextcloud&distro=openSUSE%20Leap%2015.3pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2012pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2015%20SP1pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2015%20SP2pkg:rpm/suse/nextcloud&distro=SUSE%20Package%20Hub%2015%20SP3
< 20.0.12-lp152.3.12.1+ 5 more
- (no CPE)range: < 20.0.12-lp152.3.12.1
- (no CPE)range: < 20.0.12-bp153.2.6.1
- (no CPE)range: < 20.0.12-31.1
- (no CPE)range: < 20.0.12-bp151.3.18.1
- (no CPE)range: < 20.0.12-bp152.2.12.1
- (no CPE)range: < 20.0.12-bp153.2.6.1
- nextcloud/security-advisoriesv5Range: < 20.0.12
Patches
Vulnerability mechanics
References
4- security.gentoo.org/glsa/202208-17mitrevendor-advisoryx_refsource_GENTOO
- github.com/nextcloud/security-advisories/security/advisories/GHSA-gv5w-8q25-785vmitrex_refsource_CONFIRM
- github.com/nextcloud/server/pull/28078mitrex_refsource_MISC
- hackerone.com/reports/1271052mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.