Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2023-28997
HistoryApr 04, 2023 - 1:15 p.m.

CVE-2023-28997

2023-04-0413:15:08
CWE-323
[email protected]
web.nvd.nist.gov
5
nextcloud
desktop client
synchronization
files
server
administrator
recovery
modification
end-to-end encryption
upgrade
patch
vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

42.8%

JSON

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of end-to-end encrypted files. Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Affected configurations

Nvd
Node
nextclouddesktopRange3.0.0–3.6.5
VendorProductVersionCPE
nextclouddesktop*cpe:2.3:a:nextcloud:desktop:*:*:*:*:*:*:*:*

Related

debiancve 1
alpinelinux 1
cvelist 1
nextcloud 1
veracode 1
cve 1
osv 1
prion 1
ubuntucve 1
debiancve
debiancve
CVE-2023-28997
2023-04-04 13:15:08
alpinelinux
alpinelinux
CVE-2023-28997
2023-04-04 13:15:08
cvelist
cvelist
CVE-2023-28997 Nextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access files
2023-04-04 12:42:24
nextcloud
nextcloud
Initialization vector reuse in end-to-end encryption allows a malicious server admin to break manipulate and access files
2023-04-04 07:55:23
veracode
veracode
Weak Encryption
2023-04-18 20:33:16
cve
cve
CVE-2023-28997
2023-04-04 13:15:08
osv
osv
CVE-2023-28997
2023-04-04 13:15:08
prion
prion
Design/Logic Flaw
2023-04-04 13:15:00
ubuntucve
ubuntucve
CVE-2023-28997
2023-04-04 00:00:00

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

42.8%

JSON
Related for NVD:CVE-2023-28997
debiancve1alpinelinux1cvelist1nextcloud1veracode1cve1osv1prion1ubuntucve1