CVE-2023-35173
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The Nextcloud End-to-end encryption app provides the ability to implement end-to-end encryption on the client side. By providing an invalid metadata file, an attacker can make previously dropped files inaccessible.
Risk Assessment
The organization may lose access to important data, which can lead to serious operational and legal consequences.
Recommendation
It is recommended to upgrade the Nextcloud End-to-end encryption app to version 1.12.4 that contains the fix.
Original NVD description (English source)
Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded to version 1.12.4 that contains the fix.