PT-2023-22073 · Nextcloud+2 · Nextcloud Desktop Client+2

Daniele Coppola + 3 · Published 2023-04-04 · Updated 2025-09-18 · CVE-2023-28997

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop Client versions 3.0.0 through 3.6.4

Description The issue allows a malicious server administrator to recover and modify the contents of end-to-end encrypted files. This is a significant concern for users who rely on the Nextcloud Desktop Client for synchronizing files from Nextcloud Server.

Recommendations For Nextcloud Desktop Client versions 3.0.0 through 3.6.4, upgrade to version 3.6.5 to receive a patch. At the moment, there is no other information about additional mitigation measures for this issue.

Exploit

Fix

Weakness Enumeration

CWE-323

Related Identifiers

ALT-PU-2023-2019

ALT-PU-2023-4584

ALT-PU-2023-5197

CVE-2023-28997

DLA-4303-1

GHSA-4P33-RW27-J5FC

Affected Products

Alt Linux

Debian

Nextcloud Desktop Client

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28997.json · Exploit
• 🔥 https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_DanieleCoppola.pdf · Exploit
• https://github.com/nextcloud/desktop/pull/5324 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4p33-rw27-j5fc · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-28997 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28997 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28997 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28997 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-28997 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4303-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-28997 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28997 · Security Note
• https://t.me/cibsecurity/61395 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2025/09/msg00018.html · Note