CVE-2023-28835 : What You Need to Know

This CVE involves an insecure randomness issue with default passwords in Nextcloud, impacting certain versions of the software.

Understanding CVE-2023-28835

This vulnerability pertains to the use of a weak pseudo-random number generator for default passwords in Nextcloud, potentially making them guessable to attackers.

What is CVE-2023-28835?

In affected versions of Nextcloud, the generated fallback password during share creation is not sufficiently random, making it vulnerable to brute force attacks. Users who do not have a password policy enabled are particularly at risk.

The Impact of CVE-2023-28835

The impact of this vulnerability is considered low, with confidentiality and integrity being rated as low risks. However, exploitation could lead to unauthorized access to shared resources.

Technical Details of CVE-2023-28835

This vulnerability has a CVSS v3.1 base score of 3.5, indicating a low severity level with a requirement of user interaction for exploitation.

Vulnerability Description

The issue arises from the use of a cryptographically weak pseudo-random number generator for default passwords in Nextcloud, potentially enabling attackers to guess passwords.

Affected Systems and Versions

Affected Vendor: Nextcloud
Affected Product: Security Advisories
Vulnerable Versions:
Versions < 24.0.10
Versions >= 25.0.0, < 25.0.4

Exploitation Mechanism

The vulnerability can be exploited by attackers attempting to brute force the weakly generated default passwords in affected versions of Nextcloud.

Mitigation and Prevention

To address CVE-2023-28835, immediate steps should be taken to secure Nextcloud installations and prevent unauthorized access.

Immediate Steps to Take

Upgrade Nextcloud Server to version 24.0.10 or 25.0.4 to mitigate the vulnerability.
Enable a password policy to strengthen password security for users who are unable to upgrade immediately.

Long-Term Security Practices

Regularly monitor and update Nextcloud installations to stay protected against known vulnerabilities.
Implement strong password policies and encourage users to set unique, complex passwords.

Patching and Updates

Stay informed about security advisories from Nextcloud and apply patches promptly to address identified vulnerabilities and enhance overall system security.