Every CVE Search/ Get API key

CVE-2023-23942

Self reflected HTML injection in Desktop client

5.4 MediumFix available

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.68%Down 0.2 points since Feb 7, 2023
90%50%10%1%

What each source reports

CVE List Score used 5.4

Self reflected HTML injection in Desktop client

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.

Record
CVE-2023-23942
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2023-28008 5.4

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.

Record
EUVD-2023-28008
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
NVD 5.4

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.

Record
CVE-2023-23942
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVALPINE-CVE-2023-23942 6.1

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.

Record
ALPINE-CVE-2023-23942
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
OSV 5.4

Self reflected HTML injection in Desktop client

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.

Record
CVE-2023-23942
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2023-23942 6.1

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.

Record
DEBIAN-CVE-2023-23942
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-23942 5.4

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.

Record
UBUNTU-CVE-2023-23942
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2023:0090-1 No score

Security update for nextcloud-desktop

This update for nextcloud-desktop fixes the following issues:

nextcloud-desktop was updated to 3.8.0:

  • Resize WebView widget once the loginpage rendered

  • Feature/secure file drop

  • Check German translation for wrong wording

  • L10n: Correct word

  • Fix displaying of file details button for local syncfileitem activities

  • Improve config upgrade warning dialog

  • Only accept folder setup page if overrideLocalDir is set

  • Update CHANGELOG.

  • Prevent ShareModel crash from accessing bad pointers

  • Bugfix/init value for pointers

  • Log to stdout when built in Debug config

  • Clean up account creation and deletion code

  • L10n: Added dot to end of sentence

  • L10n: Fixed grammar

  • Fix 'Create new folder' menu entries in settings not working correctly on macOS

  • Ci/clang tidy checks init variables

  • Fix share dialog infinite loading

  • Fix edit locally job not finding the user account: wrong user id

  • Skip e2e encrypted files with empty filename in metadata

  • Use new connect syntax

  • Fix avatars not showing up in settings dialog account actions until clicked on

  • Always discover blacklisted folders to avoid data loss when modifying selectivesync list.

  • Fix infinite loading in the share dialog when public link shares are disabled on the server

  • With cfapi when dehydrating files add missing flag

  • Fix text labels in Sync Status component

  • Display 'Search globally' as the last sharees list element

  • Fix display of 2FA notification.

  • Bugfix/do not restore virtual files

  • Show server name in tray main window

  • Add Ubuntu Lunar

  • Debian build classification 'beta' cannot override 'release'.

  • Update changelog

  • Follow shouldNotify flag to hide notifications when needed

  • Bugfix/stop after creating config file

  • E2EE cut extra zeroes from derypted byte array.

  • When local sync folder is overriden, respect this choice

  • Feature/e2ee fixes

  • This also fix security issues:

    • (boo#1205798, CVE-2022-39331)
      • Arbitrary HyperText Markup Language injection in notifications
    • (boo#1205799, CVE-2022-39332)
      • Arbitrary HyperText Markup Language injection in user status and information
    • (boo#1205800, CVE-2022-39333)
      • Arbitrary HyperText Markup Language injection in desktop client application
    • (boo#1205801, CVE-2022-39334)
      • Client incorrectly trusts invalid TLS certificates
    • (boo#1207976, CVE-2023-23942)
      • missing sanitisation on qml labels leading to javascript injection

  • Update to 3.7.4

    • check German translation for wrong wording
    • Fix 'Create new folder' menu entries in settings not working correctly on macOS
    • Clean up account creation and deletion code
    • Fix share dialog infinite loading
    • fix edit locally job not finding the user account: wrong user id
    • skip e2e encrypted files with empty filename in metadata
    • Always discover blacklisted folders to avoid data loss when modifying selectivesync list.
    • use new connect syntax
    • with cfapi when dehydrating files add missing flag
    • Fix avatars not showing up in settings dialog account actions until clicked on
    • Fix text labels in Sync Status component
    • Fix infinite loading in the share dialog when public link shares are disabled on the server
    • Ci/clang tidy checks init variables
    • Display 'Search globally' as the last sharees list element
    • Resize WebView widget once the loginpage rendered
    • Bugfix/do not restore virtual files
    • Fix display of 2FA notification.

  • Update to 3.7.3

    • Revert 'Fix(l10n): capital_abcd Update translations from Transifex'
    • Revert 'Fix(l10n): capital_abcd Update translations from Transifex'
    • Revert 'Fix(l10n): capital_abcd Update translations from Transifex'

  • Update to 3.7.2

  • Update to 3.7.1

    • Backport/5393/stable 3.7 by @mgallien in #5403
    • Fix wrong estimated time when doing sync. in…
Record
openSUSE-SU-2023:0090-1
Updated
2026-11-02
OSVopenSUSE-SU-2023:0171-1 No score

Security update for nextcloud-desktop

This update for nextcloud-desktop fixes the following issues:

Update ot 3.8.0

  • Resize WebView widget once the loginpage rendered

  • Feature/secure file drop

  • Check German translation for wrong wording

  • L10n: Correct word

  • Fix displaying of file details button for local syncfileitem activities

  • Improve config upgrade warning dialog

  • Only accept folder setup page if overrideLocalDir is set

  • Update CHANGELOG.

  • Prevent ShareModel crash from accessing bad pointers

  • Bugfix/init value for pointers

  • Log to stdout when built in Debug config

  • Clean up account creation and deletion code

  • L10n: Added dot to end of sentence

  • L10n: Fixed grammar

  • Fix 'Create new folder' menu entries in settings not working correctly on macOS

  • Ci/clang tidy checks init variables

  • Fix share dialog infinite loading

  • Fix edit locally job not finding the user account: wrong user id

  • Skip e2e encrypted files with empty filename in metadata

  • Use new connect syntax

  • Fix avatars not showing up in settings dialog account actions until clicked on

  • Always discover blacklisted folders to avoid data loss when modifying selectivesync list.

  • Fix infinite loading in the share dialog when public link shares are disabled on the server

  • With cfapi when dehydrating files add missing flag

  • Fix text labels in Sync Status component

  • Display 'Search globally' as the last sharees list element

  • Fix display of 2FA notification.

  • Bugfix/do not restore virtual files

  • Show server name in tray main window

  • Add Ubuntu Lunar

  • Debian build classification 'beta' cannot override 'release'.

  • Update changelog

  • Follow shouldNotify flag to hide notifications when needed

  • Bugfix/stop after creating config file

  • E2EE cut extra zeroes from derypted byte array.

  • When local sync folder is overriden, respect this choice

  • Feature/e2ee fixes

  • This update also fixes security issues:

    • (boo#1205798, CVE-2022-39331)
      • Arbitrary HyperText Markup Language injection in notifications
    • (boo#1205799, CVE-2022-39332)
      • Arbitrary HyperText Markup Language injection in user status and information
    • (boo#1205800, CVE-2022-39333)
      • Arbitrary HyperText Markup Language injection in desktop client application
    • (boo#1205801, CVE-2022-39334)
      • Client incorrectly trusts invalid TLS certificates
    • (boo#1207976, CVE-2023-23942)
      • missing sanitisation on qml labels leading to javascript injection
Record
openSUSE-SU-2023:0171-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nextcloud-client
Alpine:v3.18
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.19
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.20
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.21
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.22
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.23
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.24
 before 3.6.6-r0
3.6.6-r0
nextcloud-desktop
Debian:12
 before 3.6.4-1
3.6.4-1
nextcloud-desktop
Debian:13
 before 3.6.4-1
3.6.4-1
nextcloud-desktop
Debian:14
 before 3.6.4-1
3.6.4-1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
nextcloud-desktop
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.5.3-12.6.0-12.6.1-12.6.1-22.6.2-12.6.2-1build1
 None known
nextcloud-desktop
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.2.3-0ubuntu13.3.5-13.3.5-1ubuntu13.4.2-13.4.2-1ubuntu1
 None known
nextcloud-desktop
SUSE:Package Hub 15 SP4
 before 3.8.0-bp154.2.3.1
3.8.0-bp154.2.3.1
nextcloud-desktop
openSUSE:Leap 15.4
 before 3.8.0-bp154.2.3.1
3.8.0-bp154.2.3.1
nextcloud-desktop
SUSE:Package Hub 15 SP5
 before 3.8.0-bp155.2.3.1
3.8.0-bp155.2.3.1
nextcloud-desktop
openSUSE:Leap 15.5
 before 3.8.0-bp155.2.3.1
3.8.0-bp155.2.3.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-23942 is a medium vulnerability (CVSS 5.4) in Nextcloud Desktop, published February 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in nextcloud-client 3.6.6-r0.

References

Show 16 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open