Nextcloud E2EE App <1.12.4 Metadata Injection Makes Files Unreachable
CVE-2023-35173 Published on June 23, 2023
End-to-End encrypted file-drops can be made inaccessible
Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded to version 1.12.4 that contains the fix.
Vulnerability Analysis
CVE-2023-35173 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2023-35173 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2023-35173
stack.watch emails you whenever new vulnerabilities are published in Nextcloud End To End Encryption or Nextcloud. Just hit a watch button to start following.
Affected Versions
nextcloud security-advisories Version >= 1.12.0, < 1.12.4 is affected by CVE-2023-35173Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.