← Volver a CVEs

CVE-2022-41971

MEDIUM

4.8

Descripcion

Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to see videos on a call in a public conversation after being removed from that conversation, provided that they were removed while being in the call. Versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0 contain patches for the issue. No known workarounds are available.

Detalles CVE

Puntuacion CVSS v3.14.8

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Vector de ataqueNETWORK

ComplejidadHIGH

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado12/1/2022

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

nextcloud:nextcloud_talk

Debilidades (CWE)

CWE-200CWE-359CWE-668

Referencias

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wx6w-xpg9-6fv4(security-advisories@github.com)

https://github.com/nextcloud/spreed/pull/7974(security-advisories@github.com)

https://hackerone.com/reports/1706248(security-advisories@github.com)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wx6w-xpg9-6fv4(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/nextcloud/spreed/pull/7974(af854a3a-2127-422b-91ae-364da2661108)

https://hackerone.com/reports/1706248(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.