Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4303 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4303-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     September 18, 2025                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : nextcloud-desktop     Version        : 3.1.1-2+deb11u2     CVE ID         : CVE-2022-39331 CVE-2022-39332 CVE-2022-39333 CVE-2022-39334                      CVE-2023-28997

    Multiple vulnerabilities were discovered in nextcloud-desktop,     nextcloud folder synchronization tool.

    CVE-2022-39331

        An attacker can inject arbitrary HyperText Markup Language into         the Desktop Client application in the notifications.

    CVE-2022-39332

        An attacker can inject arbitrary HyperText Markup Language into         the Desktop Client application via user status and information.

    CVE-2022-39333

        An attacker can inject arbitrary HyperText Markup Language into         the Desktop Client application.

    CVE-2022-39334

        A CLI utility called nextcloudcmd which is sometimes used for         automated scripting and headless servers would incorrectly trust         invalid TLS certificates, which may enable a Man-in-the-middle         attack that exposes sensitive data or credentials to a network         attacker.

    CVE-2023-28997

        A malicious server administrator can recover and modify the         contents of end-to-end encrypted files.

    For Debian 11 bullseye, these problems have been fixed in version     3.1.1-2+deb11u2.

    For Debian 11 bullseye, these problems have been fixed in version     3.1.1-2+deb11u2.

    We recommend that you upgrade your nextcloud-desktop packages.

    For the detailed security status of nextcloud-desktop please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nextcloud-desktop

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText     Markup Language into the Desktop Client application via user status and information. It is recommended     that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
    (CVE-2022-39332)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0171-1 advisory.

  - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText     Markup Language into the Desktop Client application in the notifications. It is recommended that the     Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
    (CVE-2022-39331)

  - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText     Markup Language into the Desktop Client application via user status and information. It is recommended     that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
    (CVE-2022-39332)

  - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText     Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client     is upgraded to 3.6.1. There are no known workarounds for this issue. (CVE-2022-39333)

  - Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and     headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS     certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a     network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud     clients, and it does not affect the Nextcloud server. (CVE-2022-39334)

  - The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer.
    Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such     as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for     javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are     no known workarounds for this issue. (CVE-2023-23942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0090-1 advisory.

  - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText     Markup Language into the Desktop Client application in the notifications. It is recommended that the     Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
    (CVE-2022-39331)

  - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText     Markup Language into the Desktop Client application via user status and information. It is recommended     that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
    (CVE-2022-39332)

  - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText     Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client     is upgraded to 3.6.1. There are no known workarounds for this issue. (CVE-2022-39333)

  - Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and     headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS     certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a     network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud     clients, and it does not affect the Nextcloud server. (CVE-2022-39334)

  - The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer.
    Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such     as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for     javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are     no known workarounds for this issue. (CVE-2023-23942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
265376	Debian dla-4303 : caja-nextcloud - security update	Nessus	Debian Local Security Checks	medium
225026	Linux Distros Unpatched Vulnerability : CVE-2022-39332	Nessus	Misc.	medium
178113	openSUSE 15 Security Update : nextcloud-desktop (openSUSE-SU-2023:0171-1)	Nessus	SuSE Local Security Checks	medium
174256	openSUSE 15 Security Update : nextcloud-desktop (openSUSE-SU-2023:0090-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2022-39332

medium

Tenable Plugins

medium

medium

medium

medium