CVE-2023-35173
MEDIUMNextcloud End-to-end Encryption 1.12.0-1.12.3 - Denial of Service via Invalid Metadata File
Title source: llmDescription
Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded to version 1.12.4 that contains the fix.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x7c7-v5r3-mg37
Patch x_refsource_misc
https://github.com/nextcloud/end_to_end_encryption/pull/435
Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1914115
Scores
CVSS v3
5.7
EPSS
0.0023
EPSS Percentile
46.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Details
CWE
CWE-284
Status
published
Products (1)
nextcloud/end-to-end_encryption
1.12.0 - 1.12.4
Published
Jun 23, 2023
Tracked Since
Feb 18, 2026