« Volver al listado

CVE-2025-47790

Estado: AnalizadaMedia (6.4)—

Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with `remember_login_cookie_lifetime` set to `0`, once the session expired on the page to select the second factor and the page is reloaded.

Leer descripción completaMostrar menos

Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the `remember_login_cookie_lifetime` in config.php to a value other than `0`, e.g. `900`. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nextcloud — Nextcloud Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-47790",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-47790",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-16T14:50:56.248971Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "nextcloud",
          "product": "security-advisories",
          "versions": [
            {
              "status": "affected",
              "version": ">= 26.0.0, < 26.0.13.15"
            },
            {
              "status": "affected",
              "version": ">= 27.0.0, < 27.1.11.15"
            },
            {
              "status": "affected",
              "version": ">= 28.0.0, < 28.0.14.6"
            },
            {
              "status": "affected",
              "version": ">= 29.0.0, < 29.0.15"
            },
            {
              "status": "affected",
              "version": ">= 30.0.0, < 30.0.9"
            },
            {
              "status": "affected",
              "version": ">= 31.0.0, < 31.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-05-16T14:15:31.823",
  "references": [
    {
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9h3w-f3h4-qqrh",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextcloud/server/pull/51905",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://hackerone.com/reports/2729367",
      "tags": [
        "Permissions Required"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with `remember_login_cookie_lifetime` set to `0`, once the session expired on the page to select the second factor and the page is reloaded. Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the `remember_login_cookie_lifetime` in config.php to a value other than `0`, e.g. `900`. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions."
    },
    {
      "lang": "es",
      "value": "Nextcloud Server es un sistema de nube personal autoalojado. Las versiones anteriores a 29.0.15, 30.0.9 y 31.0.3, y las anteriores a 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 y 31.0.3, presentan un error en la gestión de sesiones. Este error omitía la confirmación del segundo factor tras iniciar sesión correctamente con el nombre de usuario y la contraseña cuando el servidor estaba configurado con `remember_login_cookie_lifetime` a `0`, una vez que la sesión expiraba en la página para seleccionar el segundo factor y se recargaba la página. Nextcloud Server 29.0.15, 30.0.9 y 31.0.3, y Nextcloud Enterprise Server se han actualizado a 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 y 31.0.3, y contienen un parche. Como solución alternativa, configure `remember_login_cookie_lifetime` en config.php con un valor distinto de `0`, por ejemplo, `900`. Tenga en cuenta que esto solo es una solución alternativa para las nuevas sesiones creadas después del cambio de configuración. El administrador del sistema puede eliminar las sesiones afectadas."
    }
  ],
  "lastModified": "2026-06-17T09:28:41.873",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7328F84-6848-4CCF-AE2B-FA4C346A2523",
              "versionEndExcluding": "26.0.13.15",
              "versionStartIncluding": "26.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7863CA29-8512-438B-BE58-A7B920401F12",
              "versionEndExcluding": "27.1.11.15",
              "versionStartIncluding": "27.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44F5A03F-81FB-46CD-BF23-ED4B9FAE19D4",
              "versionEndExcluding": "28.0.14.6",
              "versionStartIncluding": "28.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1C480E0-6C8C-4173-8BBF-4D5A0FA6A665",
              "versionEndExcluding": "29.0.15",
              "versionStartIncluding": "29.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E367586-1350-43BC-9242-E15088F6C1C8",
              "versionEndExcluding": "29.0.15",
              "versionStartIncluding": "29.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47EB7CCF-F24C-49BD-8F26-1C948A450CBF",
              "versionEndExcluding": "30.0.9",
              "versionStartIncluding": "30.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E99B7ACC-0CDA-4E0A-B4FB-704625706899",
              "versionEndExcluding": "30.0.9",
              "versionStartIncluding": "30.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03FB07F6-B711-49EF-B5BA-AF76F9ADCB33",
              "versionEndExcluding": "31.0.3",
              "versionStartIncluding": "31.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D18619A5-629A-4CE7-A466-7AE721F08E3D",
              "versionEndExcluding": "31.0.3",
              "versionStartIncluding": "31.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}