CVE-2021-32800: Bypass of Two Factor Authentication in Nextcloud server
Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32800?
CVE-2021-32800 has a severity rating that indicates a medium risk due to its impact on Two Factor Authentication bypass.
How do I fix CVE-2021-32800?
To fix CVE-2021-32800, upgrade your Nextcloud server to a version greater than 20.0.12, 21.0.4, or 22.1.0.
Which versions of Nextcloud are affected by CVE-2021-32800?
CVE-2021-32800 affects Nextcloud versions prior to 20.0.12, 21.0.0 to 21.0.4, and 22.0.0 to 22.1.0.
Can the CVE-2021-32800 vulnerability be exploited without user credentials?
Yes, an attacker can exploit CVE-2021-32800 if they have knowledge of a user's password or access to a WebAuthN trusted device.
Is Two Factor Authentication safe to use with CVE-2021-32800?
Two Factor Authentication is compromised in affected versions due to CVE-2021-32800, making it less secure until updated.