Detections
Analytics
Alpine: multiple nextcloud-client packages: security update to 3.6.2-r0
high Tenable Self-Hosted Container Security Plugin ID 405728
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In
version 3.6.0, if a user received a malicious file share and has it synced locally or the virtual
filesystem enabled and clicked a nc://open/ link it will open the default editor for the file type of the
shared file, which on Windows can also sometimes mean that a file depending on the type, e.g. "vbs", is
being executed. It is recommended that the Nextcloud Desktop client is upgraded to version 3.6.1. As a
workaround, users can block the Nextcloud Desktop client 3.6.0 by setting the
`minimum.supported.desktop.version` system config to `3.6.1` on the server, so new files designed to use
this attack vector are not downloaded anymore. Already existing files can still be used. Another
workaround would be to enforce shares to be accepted by setting the `sharing.force_share_accept` system
config to `true` on the server, so new files designed to use this attack vector are not downloaded
anymore. Already existing shares can still be abused. (CVE-2022-41882)
- Deck is a kanban style organization tool aimed at personal planning and project organization for teams
integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body
given they click on a malicious deep link on a Windows computer. (e.g. in an email, chat link, etc). There
are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to
3.6.2. (CVE-2023-22472)
See Also
Plugin Details
Severity: High
ID: 405728
Version: Revision 1.47
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-22472
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 11/11/2022
Reference Information
CVE: CVE-2022-41882, CVE-2023-22472