Vulnerability · Published Apr 17, 2023 · Assigned by GitHub_M

CVE-2023-30540Chat poll data can still be queried from API after purging history in Nextcloud talk

Low 3.5

In plain English

A low-severity information exposure in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.7%top 48.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has been patched in version 15.0.5 and it is recommended that users upgrad to 15.0.5. There are no known workarounds for this issue.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>= 15.0.0, < 15.0.5

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c9hr-cq65-9mjw x_refsource_CONFIRM
https://github.com/nextcloud/spreed/pull/8985 x_refsource_MISC
https://hackerone.com/reports/1894676 x_refsource_MISC