Lucene search

GitHub_MCVE-2022-24887

HistoryApr 27, 2022 - 2:15 p.m.

CVE-2022-24887

2022-04-2714:15:09

CWE-601

GitHub_M

web.nvd.nist.gov

nextcloud talk

video conferencing

audio conferencing

security vulnerability

cve-2022-24887

nvd

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

42.2%

JSON

Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sharing a Deck card in conversation, the metaData can be manipulated so users can be tricked into opening arbitrary URLs. This issue is fixed in versions 11.3.4, 12.2.2, and 13.0.0. There are currently no known workarounds.

Affected configurations

Nvd

Vulners

Node

nextcloudtalkRange<11.3.4

nextcloudtalkRange12.0.0–12.2.4

nextcloudtalkMatch13.0.0rc1

nextcloudtalkMatch13.0.0rc2

nextcloudtalkMatch13.0.0rc3

nextcloudtalkMatch13.0.0rc4

VendorProductVersionCPE
nextcloudtalk*cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*
nextcloudtalk13.0.0cpe:2.3:a:nextcloud:talk:13.0.0:rc1:*:*:*:*:*:*
nextcloudtalk13.0.0cpe:2.3:a:nextcloud:talk:13.0.0:rc2:*:*:*:*:*:*
nextcloudtalk13.0.0cpe:2.3:a:nextcloud:talk:13.0.0:rc3:*:*:*:*:*:*
nextcloudtalk13.0.0cpe:2.3:a:nextcloud:talk:13.0.0:rc4:*:*:*:*:*:*

Vendor	Product	Version	CPE
nextcloud	talk	*	cpe:2.3:a:nextcloud:talk::::::::
nextcloud	talk	13.0.0	cpe:2.3:a:nextcloud:talk:13.0.0:rc1::::::
nextcloud	talk	13.0.0	cpe:2.3:a:nextcloud:talk:13.0.0:rc2::::::
nextcloud	talk	13.0.0	cpe:2.3:a:nextcloud:talk:13.0.0:rc3::::::
nextcloud	talk	13.0.0	cpe:2.3:a:nextcloud:talk:13.0.0:rc4::::::

CNA Affected

[
  {
    "product": "security-advisories",
    "vendor": "nextcloud",
    "versions": [
      {
        "status": "affected",
        "version": "< 11.3.4"
      },
      {
        "status": "affected",
        "version": "< 12.2.2"
      },
      {
        "status": "affected",
        "version": "< 13.0.0"
      }
    ]
  }
]

References

github.com/nextcloud/security-advisories/security/advisories/GHSA-j45w-7mpq-264c

github.com/nextcloud/spreed/pull/6410

hackerone.com/reports/1358977

Social References

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

42.2%

JSON

Related for CVE-2022-24887