← Back

CVE-2023-28998

nvd nist
Published: Apr 4, 2023Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Exploitability: 0.9 / Impact: 5.2
Source: NVD

Description

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Affected (1)

Products: Nextcloud: Desktop
Nextcloud
1 product
Desktop
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Desktop
From 3.0.0 to 3.6.5

Related CWEs

CWE-325
Missing Cryptographic Step
The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

References (6)

Source: security-advisories@github.com
ExploitTechnical DescriptionThird Party Advisory
Source: security-advisories@github.com
PatchVendor Advisory
Source: security-advisories@github.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitTechnical DescriptionThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.