CVE-2018-3775

HIGH

8.8

CVSS Severity Score

EPSS Score0.1230%

EPSS Percentile31.55th

PublishedAug 12, 2018

Last ModifiedNov 21, 2024

Vulnerability Description

Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication.

Affected Platforms (CPE)

📦

Nextcloud

Nextcloud Server

< 12.0.3

References & Advisories

🔗 https://hackerone.com/reports/248656

🔗 https://nextcloud.com/security/advisory/?id=NC-SA-2018-007

🔗 https://hackerone.com/reports/248656

🔗 https://nextcloud.com/security/advisory/?id=NC-SA-2018-007

Related Vulnerabilities

CVE-2019-54769.8

An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to...

CVE-2021-229159.8

Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in ...

CVE-2021-328029.3

Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file...

CVE-2021-228798.8

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malic...