8.1

CVE-2021-32689

Nextcloud Talk not properly disassociating users from chats after account deletion

Nextcloud Talk not properly disassociating users from chats after account deletion

Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and 11.3.0. As a workaround, don't allow users to choose usernames themselves. This is the default behaviour of Nextcloud, but some user providers may allow doing so.
Mögliche Gegenmaßnahme
Nextcloud Talk: Don't allow users to choose usernames themselves. This is the default behaviour of Nextcloud, but some user providers may allow doing so. (e.g. the registration app)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Talk Version < 11.2.2
Weitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt Nextcloud Talk
Version >= 0.0.0, < 11.2.2
Version >= 11.3.0, < 11.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.489
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
security-advisories@github.com 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-708 Incorrect Ownership Assignment

The product assigns an owner to a resource, but the owner is outside of the intended control sphere.