Skip to content
OpenAdvisories
High · 8.1 CVE-2021-32800 EUVD-2021-19560

Bypass of Two Factor Authentication in Nextcloud server

Published Sep 7, 2021 · Updated Aug 3, 2024 · Assigned by GitHub_M

Vendor: Nextcloud Product: security-advisories

Description

Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.

Affected products

VendorProductAffectedFixed
nextcloud security-advisories < 20.0.12, >= 21.0.0, < 21.0.4, >= 22.0.0, < 22.1.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP3 nextcloud 20.0.12-bp153.2.6.1 openSUSE-SU-2021:1255-1
SUSE Package Hub 15 SP2 nextcloud 20.0.12-bp152.2.12.1 openSUSE-SU-2021:1275-1
SUSE Package Hub 15 SP1 nextcloud 20.0.12-bp151.3.18.1 openSUSE-SU-2021:1250-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Package Hub 12 nextcloud 20.0.12-31.1 openSUSE-SU-2021:1252-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.3 nextcloud 20.0.12-bp153.2.6.1 openSUSE-SU-2021:1255-1
openSUSE Leap 15.2 nextcloud 20.0.12-lp152.3.12.1 openSUSE-SU-2021:1253-1

Advisories 5

References