WebAuthn Improper Configuration in Nextcloud Server 19.0.1
CVE-2020-8236

6.8MEDIUM

Key Information:

Vendor

Nextcloud
Status
Nextcloud Server
Vendor
CVE Published:
2 November 2020

What is CVE-2020-8236?

In Nextcloud Server version 19.0.1, a configuration flaw related to passwordless WebAuthn allows users to mistakenly believe they are experiencing two-factor verification. It prompts for a PIN without properly validating it, creating a deceptive perception of security for the users.

Affected Version(s)

Nextcloud Server 19.0.2

References

https://hackerone.com/reports/924393
x_refsource_MISC
https://nextcloud.com/security/advisory/?id=NC-SA-2020-037
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.