The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt files with a key known to the attacker. This issue is fixed in Nextcloud Desktop 3.7.0. No known workarounds are available.
Advisories
Source ID Title
EUVD EUVD EUVD-2023-32618 The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt files with a key known to the attacker. This issue is fixed in Nextcloud Desktop 3.7.0. No known workarounds are available.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00573}

epss

{'score': 0.00477}


Tue, 11 Feb 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-02-11T16:20:51.424Z

Reserved: 2023-03-29T17:39:16.142Z

Link: CVE-2023-29000

cve-icon Vulnrichment

Updated: 2024-08-02T13:51:38.991Z

cve-icon NVD

Status : Modified

Published: 2023-04-04T13:15:09.067

Modified: 2024-11-21T07:56:22.213

Link: CVE-2023-29000

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.