CVE-2023-28999

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files. This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-325 CWE-311

Affected software

No affected versions have been published.

Timeline

Published: Apr 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-29007.5A vulnerability was found in NFine Rapid Development Platform 20230511. It has been classified as problematic. Affected is an unknown functi CVE-2023-290006.5The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, b CVE-2023-290017.5Contiki-NG is an open-source, cross-platform operating system for IoT devices. The Contiki-NG operating system processes source routing head CVE-2023-290026.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the conte CVE-2023-290038.8SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by de CVE-2023-290046.5hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in th CVE-2023-290057.5Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 include CVE-2023-290068.8The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.CVE-2023-290077.8Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40 CVE-2023-290088.8The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing end CVE-2023-290096.1baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to CVE-2023-29016.5A vulnerability was found in NFine Rapid Development Platform 20230511. It has been declared as problematic. Affected by this vulnerability