PT-2023-22073 · Nextcloud+2 · Nextcloud Desktop Client+2

Daniele Coppola + 3 · Publicado 2023-04-04 · Atualizado 2025-09-18 · CVE-2023-28997

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop Client versions 3.0.0 through 3.6.4

Description The issue allows a malicious server administrator to recover and modify the contents of end-to-end encrypted files. This is a significant concern for users who rely on the Nextcloud Desktop Client for synchronizing files from Nextcloud Server.

Recommendations For Nextcloud Desktop Client versions 3.0.0 through 3.6.4, upgrade to version 3.6.5 to receive a patch. At the moment, there is no other information about additional mitigation measures for this issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-323

Identificadores relacionados

ALT-PU-2023-2019

ALT-PU-2023-4584

ALT-PU-2023-5197

CVE-2023-28997

DLA-4303-1

GHSA-4P33-RW27-J5FC

Produtos afetados

Alt Linux

Debian

Nextcloud Desktop Client

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28997.json · Exploit
• 🔥 https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_DanieleCoppola.pdf · Exploit
• https://github.com/nextcloud/desktop/pull/5324 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4p33-rw27-j5fc · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-28997 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28997 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-28997 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-28997 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-28997 · Aviso do Fabricante
• https://t.me/cibsecurity/61395 · Publicação no Telegram
• https://lists.debian.org/debian-lts-announce/2025/09/msg00018.html · Nota
• https://osv.dev/vulnerability/DLA-4303-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-28997 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-28997 · Nota de Segurança