Vulnerability · Published Mar 8, 2022 · Assigned by GitHub_M

CVE-2021-41181Nextcloud Talk app exposes chat messages on lockscreen

Low 2.4

In plain English

A low-severity information exposure in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.3%top 76.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone call the attacker could gain access to the chat messages and files of the user. It is recommended that the Nextcloud Android Talk App is upgraded to 12.3.0. There are no known workarounds.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 12.3.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-497c-c8hx-6qcf x_refsource_CONFIRM
https://github.com/nextcloud/talk-android/pull/1585 x_refsource_MISC