Cyber Resilience

CVE-2023-28643

Nextcloud Server 24.0.0 – 24.0.9

Public PoC
Published
30 March 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
EPSS Score 0.0079 53th percentile
Risk Priority 47 floored blend · peak EPSS

Summary

CVE-2023-28643 is a medium-severity Use of Incorrectly-Resolved Name or Reference (CWE-706) vulnerability in Nextcloud Nextcloud Server. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed…

more

to `{name} (2)`. It is recommended that the Nextcloud Server is upgraded to 25.0.3 or 24.0.9. Users unable to upgrade should avoid sharing 2 folders with the same name to the same user.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1034 Path Interception Persistence
**This technique has been deprecated.
T1574.008 Path Interception by Search Order Hijacking Stealth
Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs.
T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-52515Same product: Nextcloud Nextcloud Server
CVE-2023-48302Same product: Nextcloud Nextcloud Server
CVE-2025-47791Same product: Nextcloud Nextcloud Server
CVE-2026-45279Same product: Nextcloud Nextcloud Server
CVE-2026-45690Same product: Nextcloud Nextcloud Server
CVE-2023-28644Same product: Nextcloud Nextcloud Server
CVE-2023-48305Same product: Nextcloud Nextcloud Server
CVE-2024-37315Same product: Nextcloud Nextcloud Server
CVE-2023-28835Same product: Nextcloud Nextcloud Server
CVE-2023-39962Same product: Nextcloud Nextcloud Server

Affected Assets

nextcloud
nextcloud server
24.0.0 — 24.0.9 · 24.0.0 — 24.0.9 · 25.0.0 — 25.0.3

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices directly prevent incorrect name/reference resolution bugs during coding.

PR.AA-05 partial match
prevents

Enforced authorization boundaries limit damage from an incorrectly resolved reference.

PR.IR-01 partial match
prevents

Logical segmentation and access controls reduce the chance an out-of-sphere resolution succeeds.

PR.PS-01 partial match
prevents

Hardened configuration baselines can constrain allowable name-to-resource mappings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect incorrect name or reference resolution through fuzzing and negative test cases.

degrades

Network segmentation and routing policies reduce the chance that a mis-resolved name leads to an unintended external resource.

degrades

Segregated networks limit the blast radius when a name or reference resolves outside the intended control sphere.

prevents

Secure SDLC practices include design reviews that can catch incorrect name or reference handling before deployment.

prevents

Application security requirements can mandate validation of all external references and names used at runtime.

prevents

Secure architecture principles discourage reliance on ambient or globally-resolvable names without explicit scoping.

References