{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T07:46:55.276","vulnerabilities":[{"cve":{"id":"CVE-2020-8236","sourceIdentifier":"support@hackerone.com","published":"2020-11-02T21:15:34.867","lastModified":"2026-06-17T03:26:06.447","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it."},{"lang":"es","value":"Una configuración incorrecta en Nextcloud Server versión 19.0.1, hizo que el usuario sintiera incorrectamente que WebAuthn sin contraseña también era una verificación de dos factores al solicitar el PIN de WebAuthn sin contraseña pero sin verificarlo"}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"n/a","product":"Nextcloud Server","versions":[{"version":"19.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","baseScore":4.6,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*","versionEndExcluding":"19.0.2","matchCriteriaId":"DC2E71AB-4078-49DD-B276-7CC5990A792B"}]}]}],"references":[{"url":"https://hackerone.com/reports/924393","source":"support@hackerone.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://nextcloud.com/security/advisory/?id=NC-SA-2020-037","source":"support@hackerone.com","tags":["Broken Link","Vendor Advisory"]},{"url":"https://hackerone.com/reports/924393","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://nextcloud.com/security/advisory/?id=NC-SA-2020-037","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Vendor Advisory"]}]}}]}