Vulnerability · Published Dec 1, 2022 · Assigned by GitHub_M
CVE-2022-41971Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation
Medium 4.8
In plain English
A medium-severity information exposure in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities).
Official description
Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to see videos on a call in a public conversation after being removed from that conversation, provided that they were removed while being in the call. Versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0 contain patches for the issue. No known workarounds are available.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | < 12.2.8>= 13.0.0, < 13.0.10>= 14.0.0, < 14.0.6 |
Weakness: CWE-359, CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wx6w-xpg9-6fv4 x_refsource_CONFIRM
- https://github.com/nextcloud/spreed/pull/7974 x_refsource_MISC
- https://hackerone.com/reports/1706248 x_refsource_MISC