CVE-2020-8236 - AskarLabs CVE Database

CVE-2020-8236

Vendor N/A

Product Nextcloud Server

Weakness CWE-287 · Improper authentication

Published October 30, 2020

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it.

Key dates

02Disclosure timeline

October 30, 2020 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-8236 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html

Related vulnerabilities

04Related CVE

CVE-2023-3591 Lack of previous password reset tokens on new token creation CVE-2021-21308 Improper session management for soft logout CVE-2023-3127 Improper Authentication in iSTAR CVE-2026-7630 innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication CVE-2026-10611 OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled