PT-2023-22073

CVE-2023-28997

Published

2023-04-04

Updated

2026-10-31

Description by

CVSS 3.1

6.7

Medium

MetricsAV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop Client versions 3.0.0 through 3.6.4

Description The issue allows a malicious server administrator to recover and modify the contents of end-to-end encrypted files. This is a significant concern for users who rely on the Nextcloud Desktop Client for synchronizing files from Nextcloud Server.

Recommendations For Nextcloud Desktop Client versions 3.0.0 through 3.6.4, upgrade to version 3.6.5 to receive a patch. At the moment, there is no other information about additional mitigation measures for this issue.

Exploitability

Exploit

Fix

Researchers

Vendors

Affected products

Weakness enumeration

CWE-323: Reusing a Nonce, Key Pair in Encryption