CVE-2024-37313
Unknown
Unknown - Not Provided
BaseFortify
Vulnerability report for CVE-2024-37313, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2024-06-14
Last updated on: 2025-09-26
Assigner: GitHub, Inc.
Description
Description
Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nextcloud | nextcloud_server | From 21.0.0 (inc) to 21.0.9.17 (exc) |
| nextcloud | nextcloud_server | From 22.0.0 (inc) to 22.2.10.22 (exc) |
| nextcloud | nextcloud_server | From 23.0.0 (inc) to 23.0.12.17 (exc) |
| nextcloud | nextcloud_server | From 24.0.0 (inc) to 24.0.12.13 (exc) |
| nextcloud | nextcloud_server | From 25.0.0 (inc) to 25.0.13.8 (exc) |
| nextcloud | nextcloud_server | From 26.0.0 (inc) to 26.0.13 (exc) |
| nextcloud | nextcloud_server | From 26.0.0 (inc) to 26.0.13 (exc) |
| nextcloud | nextcloud_server | From 27.0.0 (inc) to 27.1.8 (exc) |
| nextcloud | nextcloud_server | From 27.0.0 (inc) to 27.1.8 (exc) |
| nextcloud | nextcloud_server | From 28.0.0 (inc) to 28.0.4 (exc) |
| nextcloud | nextcloud_server | From 28.0.0 (inc) to 28.0.4 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-NVD-CWE-noinfo |
