CVE-2023-28845

Published Mar 31, 2023

Last updated 2 years ago

Overview

Description: Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they themselves are not members. It is recommended that the Nextcloud Talk is upgraded to 14.0.9 or 15.0.4. There are no known workarounds for this vulnerability.
Source: security-advisories@github.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 3.5
Impact score: 1.4
Exploitability score: 2.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Severity: LOW

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
security-advisories@github.com: CWE-284

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "63F79F95-3A0B-4628-B84E-1FD4A680136E",
            "versionEndExcluding": "14.0.9",
            "versionStartIncluding": "14.0.0"
          },
          {
            "criteria": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F94C5DA0-430B-42B1-9FCC-C8D6A533F414",
            "versionEndExcluding": "15.0.4",
            "versionStartIncluding": "15.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References