PT-2023-22073

CVE-2023-28997

Publicado

2023-04-04

Atualizado

2026-10-31

Descrição por

CVSS 3.1

6.7

Média

MétricasAV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop Client versions 3.0.0 through 3.6.4

Description The issue allows a malicious server administrator to recover and modify the contents of end-to-end encrypted files. This is a significant concern for users who rely on the Nextcloud Desktop Client for synchronizing files from Nextcloud Server.

Recommendations For Nextcloud Desktop Client versions 3.0.0 through 3.6.4, upgrade to version 3.6.5 to receive a patch. At the moment, there is no other information about additional mitigation measures for this issue.

Explorabilidade

Exploit

Correção

Pesquisadores

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-323: Reusing a Nonce, Key Pair in Encryption