Lucene search

GitHub_MCVE-2022-35932

HistoryAug 12, 2022 - 4:15 p.m.

CVE-2022-35932

2022-08-1216:15:08

CWE-307

CWE-359

GitHub_M

web.nvd.nist.gov

nextcloud

talk

cve-2022-35932

vulnerability

brute force

password

upgrade

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.002

Percentile

57.8%

JSON

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is upgraded to 12.2.7, 13.0.7 or 14.0.3. There are currently no known workarounds available apart from not having password protected conversations.

Affected configurations

Nvd

Vulners

Node

nextcloudtalkRange<12.2.7

nextcloudtalkRange13.0.0–13.0.7

nextcloudtalkRange14.0.0–14.0.3

VendorProductVersionCPE
nextcloudtalk*cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nextcloud	talk	*	cpe:2.3:a:nextcloud:talk::::::::

CNA Affected

[
  {
    "product": "security-advisories",
    "vendor": "nextcloud",
    "versions": [
      {
        "status": "affected",
        "version": ">= 12.2.0, < 12.2.7"
      },
      {
        "status": "affected",
        "version": ">= 13.0.0, < 13.0.7"
      },
      {
        "status": "affected",
        "version": ">= 14.0.0, < 14.0.3"
      }
    ]
  }
]

References

github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq

github.com/nextcloud/spreed/commit/04300bbed0e87ff3420b5d752bbc48e2c15f35e9

github.com/nextcloud/spreed/commit/10341b9fe59a44ae0d139c072abd6b5026f33771

github.com/nextcloud/spreed/commit/f5ac73940f9f683b11e518d1c54150bf50dab9be

github.com/nextcloud/spreed/pull/7504

github.com/nextcloud/spreed/pull/7535

github.com/nextcloud/spreed/pull/7536

github.com/nextcloud/spreed/pull/7537

hackerone.com/reports/1596673

Social References

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.002

Percentile

57.8%

JSON

Related for CVE-2022-35932