PT-2023-22077 · Nextcloud+2 · Nextcloud Desktop Client+2

Mikaelgundersen · Publicado 2023-04-04 · Atualizado 2023-08-30 · CVE-2023-29000

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop Client versions 3.0.0 through 3.6.x

Description The Nextcloud Desktop Client synchronizes files from Nextcloud Server. A malicious server could exploit the client's trust in the server's certificate, leading to the encryption of files with a key known to the attacker.

Recommendations For Nextcloud Desktop Client versions 3.0.0 through 3.6.x, update to version 3.7.0 to resolve the issue.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2023-2019

ALT-PU-2023-4584

ALT-PU-2023-5197

CVE-2023-29000

GHSA-H82X-98Q3-7534

Produtos afetados

Alt Linux

Debian

Nextcloud Desktop Client

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29000.json · Exploit
• https://github.com/nextcloud/desktop/pull/4949 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h82x-98q3-7534 · Aviso do Fabricante
• https://t.me/cibsecurity/61398 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-29000 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-29000 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-29000 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-29000 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-29000 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2023-29000 · Aviso do Fabricante
• https://hackerone.com/reports/1679267 · Nota
• https://ubuntu.com/security/CVE-2023-29000 · Aviso do Fabricante