CVE-2025-47790

Summary

Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with remember_login_cookie_lifetime set to 0, once the session expired on the page to select the second factor and the page is reloaded. Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the remember_login_cookie_lifetime in config.php to a value other than 0, e.g. 900. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions.

Affected Software

VendorProductVersion RangeStatus
nextcloudsecurity-advisories>= 26.0.0, < 26.0.13.15affected
nextcloudsecurity-advisories>= 27.0.0, < 27.1.11.15affected
nextcloudsecurity-advisories>= 28.0.0, < 28.0.14.6affected
nextcloudsecurity-advisories>= 29.0.0, < 29.0.15affected
nextcloudsecurity-advisories>= 30.0.0, < 30.0.9affected
nextcloudsecurity-advisories>= 31.0.0, < 31.0.3affected

Weaknesses

  • CWE-287: CWE-287: Improper Authentication

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References