CVE-2023-35173

    Dashboard / Vulnerabilities / CVE-2023-35173

    CVE-2023-35173

    Published: 23 Jun 2023Last Modified: 12 Aug 2026

    Summary: End-to-End encrypted file-drops can be made inaccessible

    Details: Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded to version 1.12.4 that contains the fix.

    References: https://hackerone.com/reports/1914115, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35173.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x7c7-v5r3-mg37, https://nvd.nist.gov/vuln/detail/CVE-2023-35173, https://github.com/nextcloud/end_to_end_encryption/pull/435

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4ad4a9e14f766a2cef0ad0f8622e9afba1a3636d
    Fixed -66e8caeba3916fe2c942d5d2737ce176b6e74ea9

    Affected versions

    v1.12.3
    v1.12.2
    v1.12.1
    v1.12.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-35173 | CVE-DB