Vulnerability · Published Sep 16, 2022 · Assigned by GitHub_M

CVE-2022-39212Last video frame is still sent after video is disabled in a call in Nextcloud Talk

Medium 4.3

In plain English

A medium-severity information exposure in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 47.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected versions an attacker could see the last video frame of any participant who has video disabled but a camera selected. It is recommended that the Nextcloud Talk app is upgraded to 13.0.8 or 14.0.4. Users unable to upgrade should select "None" as camera before joining the call.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 13.0.8>= 14.0.0, < 14.0.4

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wq3g-2x46-q2gv x_refsource_CONFIRM
https://github.com/nextcloud/spreed/pull/7673 x_refsource_MISC