Intel

CVE-2023-28997

desktop: Reusing a Nonce, Key Pair in Encryption (CVE-2023-28997)

mediumEPSS 1.1%

Description

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of end-to-end encrypted files. Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Source: CVELISTV5NVD

Metrics

Severity
medium
Priority score
74.65
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
6.7
Source: cna-v3
CVSS v3
6.7
CVSS v4
—
EPSS percentile
64.0 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
1.1 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2023-04-04 12:42 UTC
CWE
CWE-323

Weakness classes (CWE)

  • CWE-323Base

    Reusing a Nonce, Key Pair in Encryption

    Nonces should be used for the present occasion and only once.

    cwe.mitre.org →

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • nextcloud

    desktop3.0.0 – 3.6.5

References & sources

IDCVE-2023-28997