CVE-2023-28999 Vulnerability Analysis & Exploit Details

CVE-2023-28999
Vulnerability Scoring

6.9
/10
High Risk

If left unpatched, CVE-2023-28999 could lead to major system disruptions or data loss.

Attack Complexity Details

  • Attack Complexity: Low
    Exploits can be performed without significant complexity or special conditions.
  • Attack Vector: Physical
    Physical access is required to exploit this vulnerability.
  • Privileges Required: High
    High-level privileges are required for exploitation.
  • Scope: Changed
    Successful exploitation can impact components beyond the vulnerable component.
  • User Interaction: Required
    User interaction is necessary for successful exploitation.

CVE-2023-28999 Details

Status: Modified

Last updated: 🕢 21 Nov 2024, 07:56 UTC
Originally published on: 🕐 04 Apr 2023, 13:15 UTC

Time between publication and last update: 596 days

CVSS Release: version 3

CVSS3 Source

security-advisories@github.com

CVSS3 Type

Secondary

CVSS3 Vector

CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

CVE-2023-28999 Vulnerability Summary

CVE-2023-28999: Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.

Assessing the Risk of CVE-2023-28999

Access Complexity Graph

The exploitability of CVE-2023-28999 depends on two key factors: attack complexity (the level of effort required to execute an exploit) and privileges required (the access level an attacker needs).

Exploitability Analysis for CVE-2023-28999

The exploitability of CVE-2023-28999 is influenced by multiple factors. Security teams should analyze system configurations and apply appropriate countermeasures to mitigate threats.

Understanding AC and PR

A lower complexity and fewer privilege requirements make exploitation easier. Security teams should evaluate these aspects to determine the urgency of mitigation strategies, such as patch management and access control policies.

Attack Complexity (AC) measures the difficulty in executing an exploit. A high AC means that specific conditions must be met, making an attack more challenging, while a low AC means the vulnerability can be exploited with minimal effort.

Privileges Required (PR) determine the level of system access necessary for an attack. Vulnerabilities requiring no privileges are more accessible to attackers, whereas high privilege requirements limit exploitation to authorized users with elevated access.

CVSS Score Breakdown Chart

Above is the CVSS Sub-score Breakdown for CVE-2023-28999, illustrating how Base, Impact, and Exploitability factors combine to form the overall severity rating. A higher sub-score typically indicates a more severe or easier-to-exploit vulnerability.

CIA Impact Analysis

Below is the Impact Analysis for CVE-2023-28999, showing how Confidentiality, Integrity, and Availability might be affected if the vulnerability is exploited. Higher values usually signal greater potential damage.

  • Confidentiality: High
    Exploiting CVE-2023-28999 can result in unauthorized access to sensitive data, severely compromising data privacy.
  • Integrity: High
    CVE-2023-28999 could allow unauthorized modifications to data, potentially affecting system reliability and trust.
  • Availability: Low
    CVE-2023-28999 may slightly degrade system performance without fully affecting service availability.

Exploit Prediction Scoring System (EPSS)

The EPSS score estimates the probability that this vulnerability will be exploited in the near future.

EPSS Score: 0.183% (probability of exploit)

EPSS Percentile: 56.75% (lower percentile = lower relative risk)
This vulnerability is less risky than approximately 43.25% of others.

CVE-2023-28999 References

External References

CWE Common Weakness Enumeration

CWE-311

CAPEC Common Attack Pattern Enumeration and Classification

  • Sniffing Attacks CAPEC-157 In this attack pattern, the adversary intercepts information transmitted between two third parties. The adversary must be able to observe, read, and/or hear the communication traffic, but not necessarily block the communication or change its content. Any transmission medium can theoretically be sniffed if the adversary can examine the contents between the sender and recipient. Sniffing Attacks are similar to Adversary-In-The-Middle attacks (CAPEC-94), but are entirely passive. AiTM attacks are predominantly active and often alter the content of the communications themselves.
  • Sniffing Network Traffic CAPEC-158 In this attack pattern, the adversary monitors network traffic between nodes of a public or multicast network in an attempt to capture sensitive information at the protocol level. Network sniffing applications can reveal TCP/IP, DNS, Ethernet, and other low-level network communication information. The adversary takes a passive role in this attack pattern and simply observes and analyzes the traffic. The adversary may precipitate or indirectly influence the content of the observed transaction, but is never the intended recipient of the target information.
  • Lifting Sensitive Data Embedded in Cache CAPEC-204 An adversary examines a target application's cache, or a browser cache, for sensitive information. Many applications that communicate with remote entities or which perform intensive calculations utilize caches to improve efficiency. However, if the application computes or receives sensitive information and the cache is not appropriately protected, an attacker can browse the cache and retrieve this information. This can result in the disclosure of sensitive information.
  • Accessing/Intercepting/Modifying HTTP Cookies CAPEC-31 This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third form is when the cookie's content is modified by the adversary before it is sent back to the server. Here the adversary seeks to convince the target server to operate on this falsified information.
  • Retrieve Embedded Sensitive Data CAPEC-37 An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.
  • Harvesting Information via API Event Monitoring CAPEC-383 An adversary hosts an event within an application framework and then monitors the data exchanged during the course of the event for the purpose of harvesting any important data leaked during the transactions. One example could be harvesting lists of usernames or userIDs for the purpose of sending spam messages to those users. One example of this type of attack involves the adversary creating an event within the sub-application. Assume the adversary hosts a "virtual sale" of rare items. As other users enter the event, the attacker records via AiTM (CAPEC-94) proxy the user_ids and usernames of everyone who attends. The adversary would then be able to spam those users within the application using an automated script.
  • Application API Message Manipulation via Man-in-the-Middle CAPEC-384 An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack can allow the attacker to gain unauthorized privileges within the application, or conduct attacks such as phishing, deceptive strategies to spread malware, or traditional web-application attacks. The techniques require use of specialized software that allow the attacker to perform adversary-in-the-middle (CAPEC-94) communications between the web browser and the remote system. Despite the use of AiTH software, the attack is actually directed at the server, as the client is one node in a series of content brokers that pass information along to the application framework. Additionally, it is not true "Adversary-in-the-Middle" attack at the network layer, but an application-layer attack the root cause of which is the master applications trust in the integrity of code supplied by the client.
  • Transaction or Event Tampering via Application API Manipulation CAPEC-385 An attacker hosts or joins an event or transaction within an application framework in order to change the content of messages or items that are being exchanged. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, substitute one item or another, spoof an existing item and conduct a false exchange, or otherwise change the amounts or identity of what is being exchanged. The techniques require use of specialized software that allow the attacker to man-in-the-middle communications between the web browser and the remote system in order to change the content of various application elements. Often, items exchanged in game can be monetized via sales for coin, virtual dollars, etc. The purpose of the attack is for the attack to scam the victim by trapping the data packets involved the exchange and altering the integrity of the transfer process.
  • Application API Navigation Remapping CAPEC-386 An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of links/buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains links/buttons that point to an attacker controlled destination. Some applications make navigation remapping more difficult to detect because the actual HREF values of images, profile elements, and links/buttons are masked. One example would be to place an image in a user's photo gallery that when clicked upon redirected the user to an off-site location. Also, traditional web vulnerabilities (such as CSRF) can be constructed with remapped buttons or links. In some cases navigation remapping can be used for Phishing attacks or even means to artificially boost the page view, user site reputation, or click-fraud.
  • Navigation Remapping To Propagate Malicious Content CAPEC-387 An adversary manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic.
  • Application API Button Hijacking CAPEC-388 An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination.
  • Signature Spoofing by Mixing Signed and Unsigned Content CAPEC-477 An attacker exploits the underlying complexity of a data structure that allows for both signed and unsigned content, to cause unsigned data to be processed as though it were signed data.
  • Cellular Traffic Intercept CAPEC-609 Cellular traffic for voice and data from mobile devices and retransmission devices can be intercepted via numerous methods. Malicious actors can deploy their own cellular tower equipment and intercept cellular traffic surreptitiously. Additionally, government agencies of adversaries and malicious actors can intercept cellular traffic via the telecommunications backbone over which mobile traffic is transmitted.
  • Sniff Application Code CAPEC-65 An adversary passively sniffs network communications and captures application code bound for an authorized client. Once obtained, they can use it as-is, or through reverse-engineering glean sensitive information or exploit the trust relationship between the client and server. Such code may belong to a dynamic update to the client, a patch being applied to a client component or any such interaction where the client is authorized to communicate with the server.

Vulnerable Configurations

  • cpe:2.3:a:nextcloud:desktop:3.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.1.0:-:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.1.0:-:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.1.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.1.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.1.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.1.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.2.0:-:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.2.0:-:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.2.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.2.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.2.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.2.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.2.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.2.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.4.0:-:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.4.0:-:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.4.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.4.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.4.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.4.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.5.0:-:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.5.0:-:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.5.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.5.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.5.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.5.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.5.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.5.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.5.0:rc4:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.5.0:rc4:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.6.0:-:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.6.0:-:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.6.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.6.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.6.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.6.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.6.6:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.7.0:-:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.7.0:-:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.7.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.7.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.7.4:-:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.7.4:-:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:desktop:3.7.4:rc1:*:*:*:*:*:*
    cpe:2.3:a:nextcloud:desktop:3.7.4:rc1:*:*:*:*:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.1.0:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.1.0:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.1.0:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.1.0:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.1.0:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.1.0:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.2.0:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.2.0:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.2.0:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.2.0:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.2.0:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.2.0:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.2.1:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.2.1:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.2.1:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.2.1:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.2.2:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.2.2:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.2.3:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.2.3:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.2.4:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.2.4:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.3.0:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.3.0:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc3:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc3:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.3.1:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.3.1:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.3.1:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.3.1:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.3.1:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.3.1:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.3.2:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.3.2:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.3.2:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.3.2:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.4.0:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.4.0:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.4.0:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.4.0:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.4.0:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.4.0:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.4.0:rc3:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.4.0:rc3:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.4.1:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.4.1:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.4.1:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.4.1:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.4.1:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.4.1:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.4.2:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.4.2:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.4.2:*:*:*:*:iphone_os:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.4.2:*:*:*:*:iphone_os:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.4.2:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.4.2:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.4.2:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.4.2:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.5.0:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.5.0:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.5.0:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.5.0:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.5.0:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.5.0:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.5.0:rc3:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.5.0:rc3:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.5.0:rc4:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.5.0:rc4:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.5.1:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.5.1:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.5.1:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.5.1:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.5.1:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.5.1:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.6.0:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.6.0:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.6.0:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.6.0:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.6.0:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.6.0:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.6.0:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.6.0:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.6.0:rc3:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.6.0:rc3:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.6.1:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.6.1:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.6.1:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.6.1:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.6.1:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.6.1:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.6.2:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.6.2:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.6.2:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.6.2:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.7.0:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.7.0:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.7.0:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.7.0:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.7.0:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.7.0:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.7.0:rc3:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.7.0:rc3:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.7.0:rc4:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.7.0:rc4:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.7.1:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.7.1:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.9.0:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.9.0:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.9.1:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.9.1:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.9.2:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.9.2:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.10.0:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.10.0:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.10.0:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.10.0:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.10.0:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.10.0:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.10.0:rc3:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.10.0:rc3:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.15.1:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.15.1:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.16.0:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.16.0:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.19.0:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.19.0:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.19.0:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.19.0:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.19.0:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.19.0:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.19.1:-:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.19.1:-:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.19.1:rc1:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.19.1:rc1:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.19.1:rc2:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.19.1:rc2:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.21.0:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.21.0:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:3.24.1:*:*:*:*:android:*:*
    cpe:2.3:a:nextcloud:nextcloud:3.24.1:*:*:*:*:android:*:*
  • cpe:2.3:a:nextcloud:nextcloud:4.7.0:*:*:*:*:iphone_os:*:*
    cpe:2.3:a:nextcloud:nextcloud:4.7.0:*:*:*:*:iphone_os:*:*

Protect Your Infrastructure against CVE-2023-28999: Combat Critical CVE Threats

Stay updated with real-time CVE vulnerabilities and take action to secure your systems. Enhance your cybersecurity posture with the latest threat intelligence and mitigation techniques. Develop the skills necessary to defend against CVEs and secure critical infrastructures. Join the top cybersecurity professionals safeguarding today's infrastructures.

Other 5 Recently Published CVEs Vulnerabilities

  • CVE-2025-3275 – The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider widget in all versions up...
  • CVE-2025-1457 – The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-S...
  • CVE-2025-1093 – The AIHub theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the generate_image function in all ver...
  • CVE-2025-3284 – The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Reques...
  • CVE-2025-3278 – The UrbanGo Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.4. This is due to the plugi...