Vulnerability · Published Feb 27, 2023 · Assigned by GitHub_M
CVE-2023-26041Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured
Low 2.6
In plain English
A low-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)2.6Low
Exploit odds (30 days)0.8%top 43.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk is upgraded to 15.0.3. There are no workaround available.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | < 15.0.3 |
Weakness: CWE-359 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j53p-r755-v4jf x_refsource_CONFIRM
- https://github.com/nextcloud/spreed/pull/8515 x_refsource_MISC
- https://hackerone.com/reports/1784310 x_refsource_MISC