CVE-2024-37313: Nextcloud server allows the by-pass the second factor
Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37313?
CVE-2024-37313 is a critical severity vulnerability due to the potential bypass of two-factor authentication.
What versions are affected by CVE-2024-37313?
CVE-2024-37313 affects Nextcloud Server versions prior to 26.0.13 and from 27.1.8 to 28.0.4, as well as specific versions of Nextcloud Enterprise Server.
How do I fix CVE-2024-37313?
To fix CVE-2024-37313, upgrade your Nextcloud Server to versions 26.0.13, 27.1.8, or 28.0.4.
What specific vulnerability does CVE-2024-37313 address?
CVE-2024-37313 addresses a vulnerability that allows the bypass of the second factor in two-factor authentication under certain conditions.
Is there a recommended version to upgrade to in order to mitigate CVE-2024-37313?
Yes, it is recommended to upgrade to Nextcloud Server versions 26.0.13, 27.1.8, or 28.0.4 to mitigate CVE-2024-37313.