Vulnerability · Published Jan 9, 2023 · Assigned by GitHub_M

CVE-2023-22473Passcode bypass on Talk-Android app

Low 2.1

In plain English

A low-severity improper access control in security-advisories from nextcloud. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)2.1Low

Exploit odds (30 days)0.6%top 52.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud files and view conversations. To exploit this the attacker needs to have physical access to the target's device. There are currently no known workarounds available. It is recommended that the Nextcloud Talk Android app is upgraded to 15.0.2.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 15.0.2

Weakness: CWE-284 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wvr4-gc4c-6vmx x_refsource_CONFIRM
https://github.com/nextcloud/talk-android/pull/2598 x_refsource_MISC
https://hackerone.com/reports/1784645 x_refsource_MISC