VYPR
← All advisories
High severity7.3NVD Advisory· Published Jun 14, 2024· Updated Jun 17, 2026

CVE-2024-37313

CVE-2024-37313

Description

Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4.

Affected products

4
  • Nextcloud/Nextcloud Enterprise Serverllm-fuzzy
    Range: 26.0.13, 27.1.8, 28.0.4
  • Nextcloud/Server2 versions
    cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*+ 1 more
    • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*range: >=21.0.0,<21.0.9.17
    • cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*range: >=26.0.0,<26.0.13
  • Nextcloud/security-advisoriescpe-rescue
    Range: >= 26.0.0, < 26.0.13

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.