CVE-2023-28997
Assigner: GitHub_M
Published: 2023-04-04T12:42:24.540Z
State: PUBLISHED
title: Nextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access files
problemTypes: descriptions: cweId: CWE-323
description: CWE-323: Reusing a Nonce, Key Pair in Encryption
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
version: 3.1
affected: vendor: nextcloud
product: security-advisories
versions: version: >= 3.0.0, < 3.6.5
status: affected
descriptions: value: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of end-to-end encrypted files. Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.
source: advisory: GHSA-4p33-rw27-j5fc
discovery: UNKNOWN