PT-2024-4351 · Nextcloud+2 · Nextcloud Server+3

Everysinglusernametaken · Published 2024-06-14 · Updated 2025-01-24 · CVE-2024-37313

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 26.0.13, 27.1.8, and 28.0.4 Nextcloud Enterprise Server versions prior to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8, and 28.0.4

Description The issue is related to a flaw in the authentication procedure of Nextcloud Server and Nextcloud Enterprise Server, which can allow a remote attacker to bypass the second factor of 2FA after successfully providing user credentials.

Recommendations For Nextcloud Server versions prior to 26.0.13, upgrade to version 26.0.13 or later. For Nextcloud Server versions prior to 27.1.8, upgrade to version 27.1.8 or later. For Nextcloud Server versions prior to 28.0.4, upgrade to version 28.0.4 or later. For Nextcloud Enterprise Server versions prior to 21.0.9.17, upgrade to version 21.0.9.17 or later. For Nextcloud Enterprise Server versions prior to 22.2.10.22, upgrade to version 22.2.10.22 or later. For Nextcloud Enterprise Server versions prior to 23.0.12.17, upgrade to version 23.0.12.17 or later. For Nextcloud Enterprise Server versions prior to 24.0.12.13, upgrade to version 24.0.12.13 or later. For Nextcloud Enterprise Server versions prior to 25.0.13.8, upgrade to version 25.0.13.8 or later. For Nextcloud Enterprise Server versions prior to 26.0.13, upgrade to version 26.0.13 or later. For Nextcloud Enterprise Server versions prior to 27.1.8, upgrade to version 27.1.8 or later. For Nextcloud Enterprise Server versions prior to 28.0.4, upgrade to version 28.0.4 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2024-14145

ALT-PU-2024-14169

ALT-PU-2025-1855

BDU:2024-04840

CVE-2024-37313

GHSA-9V72-9XV5-3P7C

Affected Products

Alt Linux

Nextcloud Enterprise Server

Nextcloud Server

Red Os

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37313.json · Exploit
• https://github.com/nextcloud/server/pull/44276 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9v72-9xv5-3p7c · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04840 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37313 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37313 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-nextcloud-27-06-24 · Note
• https://hackerone.com/reports/2419776 · Note
• https://twitter.com/CVEnew/status/1801673792860910052 · Twitter Post