CVE-2021-32800
Bypass of Two Factor Authentication in Nextcloud server
In short
An attacker could bypass Two Factor Authentication in Nextcloud by knowing only the password or having access to a trusted device, allowing unauthorized account access without needing the second authentication factor.
Technical detail
A flaw in Nextcloud's Two Factor Authentication implementation allows attackers to circumvent the second authentication mechanism using only a valid password or access to a previously registered WebAuthN device. This affects versions prior to 20.0.12, 21.0.4, and 22.1.0, with no available workaround.
Summary generated and translated by AI from the official description.
Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
nextcloud · security-advisoriesWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →