CVE-2023-28999: nextcloud desktop Missing Cryptographic Step
Vulnerability summary
CVE-2023-28999 is a medium (CVSS 6.9) Missing Cryptographic Step vulnerability in nextcloud desktop. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 04-04-2023PublishedVulnerability first disclosed.
- 11-02-2025Last modifiedVulnerability information updated.
Description
Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files. This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.4MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:LDiffers
- OSV · DebianEcosystem advisory · calculated6.4MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:LDiffers
- NVDNIST6.4MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:LDiffers
EPSS trend
Probability
0.68%
Chance of exploitation in the next 30 days
Percentile
51%
Versus all other CVEs
30-day change
0.00 pp
From 0.68% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (ethz.ch)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-325Missing Cryptographic StepThe product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
- CWE-311Missing Encryption of Sensitive DataThe product does not encrypt sensitive or critical information before storage or transmission.
Affected systems
Nextcloud3 products
- desktop≥ 3.0.0, < 3.8.0
- nextcloud≥ 3.0.5, < 4.8.0 | ≥ 3.13.0, < 3.25.0
- security-advisories≥ 3.0.0, < 3.8.0 | ≥ 3.13.0, < 3.25.0 | ≥ 3.0.5, < 4.8.0
Debian1 product
- nextcloud-desktopAll versions (No fix recorded) | < 3.9.0-1
Ubuntu1 product
- nextcloud-desktopAll versions (No fix recorded)
3 vendors · 5 products
References
6 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-8875-wxww-3rr8X Refsource CONFIRMREPORTVendor Advisory
