Lucene search

GitHub_MCVELIST:CVE-2023-22473

HistoryJan 09, 2023 - 2:07 p.m.

CVE-2023-22473 Passcode bypass on Talk-Android app

2023-01-0914:07:14

CWE-284

GitHub_M

www.cve.org

nextcloud

talk-android

passcode bypass

access

files

conversations

upgrade

2.1 Low

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

3.8 Low

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.0%

JSON

Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user’s Nextcloud files and view conversations. To exploit this the attacker needs to have physical access to the target’s device. There are currently no known workarounds available. It is recommended that the Nextcloud Talk Android app is upgraded to 15.0.2.

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": "< 15.0.2",
        "status": "affected"
      }
    ]
  }
]

References

github.com/nextcloud/security-advisories/security/advisories/GHSA-wvr4-gc4c-6vmx

github.com/nextcloud/talk-android/pull/2598

hackerone.com/reports/1784645

2.1 Low

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

3.8 Low

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.0%

JSON

Related for CVELIST:CVE-2023-22473