CVE-2022-35932
Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token.
Does this matter?
Lower severity and a low EPSS score (1.34%). Track it; it rarely justifies an emergency change on its own.
Description
Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is upgraded to 12.2.7, 13.0.7 or 14.0.3. There are currently no known workarounds available apart from not having password protected conversations.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.34% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-359, CWE-307
- Affected
- nextcloud/talk
- Source
- security-advisories@github.com
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwqIssue Tracking, Third Party Advisory
- https://github.com/nextcloud/spreed/commit/04300bbed0e87ff3420b5d752bbc48e2c15f35e9Patch, Third Party Advisory
- https://github.com/nextcloud/spreed/commit/10341b9fe59a44ae0d139c072abd6b5026f33771Patch, Release Notes, Third Party Advisory
- https://github.com/nextcloud/spreed/commit/f5ac73940f9f683b11e518d1c54150bf50dab9bePatch, Third Party Advisory
- https://github.com/nextcloud/spreed/pull/7504Issue Tracking, Patch, Third Party Advisory
- https://github.com/nextcloud/spreed/pull/7535Issue Tracking, Patch, Third Party Advisory
- https://github.com/nextcloud/spreed/pull/7536Issue Tracking, Patch, Third Party Advisory
- https://github.com/nextcloud/spreed/pull/7537Issue Tracking, Patch, Third Party Advisory
- https://hackerone.com/reports/1596673Issue Tracking, Third Party Advisory
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwqIssue Tracking, Third Party Advisory
- https://github.com/nextcloud/spreed/commit/04300bbed0e87ff3420b5d752bbc48e2c15f35e9Patch, Third Party Advisory
- https://github.com/nextcloud/spreed/commit/10341b9fe59a44ae0d139c072abd6b5026f33771Patch, Release Notes, Third Party Advisory
- https://github.com/nextcloud/spreed/commit/f5ac73940f9f683b11e518d1c54150bf50dab9bePatch, Third Party Advisory
- https://github.com/nextcloud/spreed/pull/7504Issue Tracking, Patch, Third Party Advisory
- https://github.com/nextcloud/spreed/pull/7535Issue Tracking, Patch, Third Party Advisory
- https://github.com/nextcloud/spreed/pull/7536Issue Tracking, Patch, Third Party Advisory
- https://github.com/nextcloud/spreed/pull/7537Issue Tracking, Patch, Third Party Advisory
- https://hackerone.com/reports/1596673Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.