Every CVE Search/ Get API key

CVE-2023-28998

Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys

6.7 MediumFix available

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
Low
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.68%Up 0.6 points since Apr 5, 2023
90%50%10%1%

What each source reports

CVE List Score used 6.7

Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Record
CVE-2023-28998
CVSS 3.1
6.7 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-325
Updated
2026-11-02
EUVDEUVD-2023-32616 6.7

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Record
EUVD-2023-32616
CVSS 3.1
6.7 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-03
NVD 6.7

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Record
CVE-2023-28998
CVSS 3.1
6.7 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-325
Updated
2026-11-02
OSVALPINE-CVE-2023-28998 6.1

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Record
ALPINE-CVE-2023-28998
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-03
OSV 6.7

Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Record
CVE-2023-28998
CVSS 3.1
6.7 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-325
Updated
2026-11-02
OSVDEBIAN-CVE-2023-28998 6.1

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Record
DEBIAN-CVE-2023-28998
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-28998 6.7

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available.

Record
UBUNTU-CVE-2023-28998
CVSS 3.1
6.7 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nextcloud-client
Alpine:v3.18
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.19
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.20
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.21
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.22
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.23
 before 3.6.6-r0
3.6.6-r0
nextcloud-client
Alpine:v3.24
 before 3.6.6-r0
3.6.6-r0
nextcloud-desktop
Debian:12
 before 3.7.0-1
3.7.0-1
nextcloud-desktop
Debian:13
 before 3.7.0-1
3.7.0-1
nextcloud-desktop
Debian:14
 before 3.7.0-1
3.7.0-1
nextcloud-desktop
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.5.3-12.6.0-12.6.1-12.6.1-22.6.2-12.6.2-1build1
 None known
nextcloud-desktop
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.2.3-0ubuntu13.3.5-13.3.5-1ubuntu13.4.2-13.4.2-1ubuntu1
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliases, products, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28998 is a medium vulnerability (CVSS 6.7) in Nextcloud Desktop, published April 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in nextcloud-client 3.6.6-r0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open