CVE-2023-22472
Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link
CVE-2023-22472 is a medium vulnerability (CVSS 5.3) in Nextcloud Desktop, published January 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in nextcloud-client 3.6.2-r0.
- Severity
- 5.3 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.22%EPSS, 12th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.6.2-r0nextcloud-client +6 more
Description
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. (e.g. in an email, chat link, etc). There are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.2.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextcloud-clientAlpine:v3.18 | before 3.6.2-r0 | 3.6.2-r0 |
nextcloud-clientAlpine:v3.19 | before 3.6.2-r0 | 3.6.2-r0 |
nextcloud-clientAlpine:v3.20 | before 3.6.2-r0 | 3.6.2-r0 |
nextcloud-clientAlpine:v3.21 | before 3.6.2-r0 | 3.6.2-r0 |
nextcloud-clientAlpine:v3.22 | before 3.6.2-r0 | 3.6.2-r0 |
nextcloud-clientAlpine:v3.23 | before 3.6.2-r0 | 3.6.2-r0 |
nextcloud-clientAlpine:v3.24 | before 3.6.2-r0 | 3.6.2-r0 |
What each source reports
CVE List Score used
Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. (e.g. in an email, chat link, etc). There are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.2.
- Record
CVE-2023-22472- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2023-26626
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. (e.g. in an email, chat link, etc). There are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.2.
- Record
EUVD-2023-26626- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
NVD
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. (e.g. in an email, chat link, etc). There are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.2.
- Record
CVE-2023-22472- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-22472
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. (e.g. in an email, chat link, etc). There are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.2.
- Record
ALPINE-CVE-2023-22472- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. (e.g. in an email, chat link, etc). There are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.2.
- Record
CVE-2023-22472- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-352
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.