CVE-2023-22473

2023-01-0915:15:11

CWE-284

[email protected]

web.nvd.nist.gov

talk-android

nextcloud

android

passcode bypass

security vulnerability

audio calls

video calls

nvd

2.1 Low

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

3.6 Low

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.9%

JSON

Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user’s Nextcloud files and view conversations. To exploit this the attacker needs to have physical access to the target’s device. There are currently no known workarounds available. It is recommended that the Nextcloud Talk Android app is upgraded to 15.0.2.

Affected configurations

Vulners

NVD

Node

nextcloudnextcloudRange<15.0.2

VendorProductVersionCPE
nextcloudnextcloud*cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nextcloud	nextcloud	*	cpe:2.3:a:nextcloud:nextcloud::::::::

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": "< 15.0.2",
        "status": "affected"
      }
    ]
  }
]