6.9

CVE-2023-28999

Exploit

Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders

Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.
Mögliche Gegenmaßnahme
Android: * No workaround available
Desktop: * No workaround available
iOS: * No workaround available
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Desktop Version >= 3.0.0 < 3.8.0
Nextcloud ≫ Nextcloud SwEditioniphone_os Version >= 3.0.5 < 4.8.0
Nextcloud ≫ Nextcloud SwEditionandroid Version >= 3.13.0 < 3.25.0
Weitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt Android
Version >= 3.13.0, < 3.25.0
SystemNextcloud App
≫
Produkt Desktop
Version >= 3.0.0, < 3.8.0
SystemNextcloud App
≫
Produkt iOS
Version >= 3.0.5, < 4.8.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.28% 0.797
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.4 0.9 5.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
security-advisories@github.com 6.9 0.4 6
CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
CWE-311 Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

CWE-325 Missing Cryptographic Step

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.