Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2023-28998
HistoryApr 04, 2023 - 1:15 p.m.

CVE-2023-28998

2023-04-0413:15:08
CWE-325
[email protected]
web.nvd.nist.gov
6
nextcloud
desktop client
vulnerability
upgrade
patch
encrypted folder
malicious server administrator

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

42.6%

JSON

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Affected configurations

Nvd
Node
nextclouddesktopRange3.0.0–3.6.5
VendorProductVersionCPE
nextclouddesktop*cpe:2.3:a:nextcloud:desktop:*:*:*:*:*:*:*:*

Related

debiancve 1
alpinelinux 1
nextcloud 1
cve 1
veracode 1
ubuntucve 1
prion 1
osv 1
cvelist 1
debiancve
debiancve
CVE-2023-28998
2023-04-04 13:15:08
alpinelinux
alpinelinux
CVE-2023-28998
2023-04-04 13:15:08
nextcloud
nextcloud
Desktop clients misbehaves with end-to-end encryption when the server returns an empty list of metadata keys
2023-04-04 07:55:58
cve
cve
CVE-2023-28998
2023-04-04 13:15:08
veracode
veracode
Weak Encryption
2023-04-18 20:33:15
ubuntucve
ubuntucve
CVE-2023-28998
2023-04-04 00:00:00
prion
prion
Code injection
2023-04-04 13:15:00
osv
osv
CVE-2023-28998
2023-04-04 13:15:08
cvelist
cvelist
CVE-2023-28998 Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys
2023-04-04 12:45:42

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

42.6%

JSON
Related for NVD:CVE-2023-28998
debiancve1alpinelinux1nextcloud1cve1veracode1ubuntucve1prion1osv1cvelist1