CVE-2022-35932

· LOWModified

← All CVEs

CVSS v3.1

3.5

EPSS

1.31%

Published

Aug 12, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is upgraded to 12.2.7, 13.0.7 or 14.0.3. There are currently no known workarounds available apart from not having password protected conversations.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-359CWE-307

Affected Products (3)

nextcloud · talk (up to 12.2.7)vulnerable

nextcloud · talk (up to 13.0.7)vulnerable

nextcloud · talk (up to 14.0.3)vulnerable

References (18)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq

Issue TrackingThird Party Advisory

https://github.com/nextcloud/spreed/commit/04300bbed0e87ff3420b5d752bbc48e2c15f35e9