5.3

CVE-2022-35932

Missing rate limit when trying to join a password protected Nextcloud Talk conversation

Missing rate limit when trying to join a password protected Nextcloud Talk conversation

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is upgraded to 12.2.7, 13.0.7 or 14.0.3. There are currently no known workarounds available apart from not having password protected conversations.
Mögliche Gegenmaßnahme
Talk: No workaround available apart from not having password protected conversations.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Talk Version < 12.2.7
Nextcloud ≫ Talk Version >= 13.0.0 < 13.0.7
Nextcloud ≫ Talk Version >= 14.0.0 < 14.0.3
Weitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt Talk
Version >= 0.0.0, < 12.2.7
Version >= 13.0.0, < 13.0.7
Version >= 14.0.0, < 14.0.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.05% 0.598
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
security-advisories@github.com 3.5 2.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CWE-307 Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq
Third Party Advisory
Issue Tracking
https://github.com/nextcloud/spreed/commit/04300bbed0e87ff3420b5d752bbc48e2c15f35e9
Patch
Third Party Advisory
https://github.com/nextcloud/spreed/commit/10341b9fe59a44ae0d139c072abd6b5026f33771
Patch
Third Party Advisory
Release Notes
https://github.com/nextcloud/spreed/commit/f5ac73940f9f683b11e518d1c54150bf50dab9be
Patch
Third Party Advisory
https://github.com/nextcloud/spreed/pull/7504
Patch
Third Party Advisory
Issue Tracking
https://github.com/nextcloud/spreed/pull/7535
Patch
Third Party Advisory
Issue Tracking
https://github.com/nextcloud/spreed/pull/7536
Patch
Third Party Advisory
Issue Tracking
https://github.com/nextcloud/spreed/pull/7537
Patch
Third Party Advisory
Issue Tracking
https://hackerone.com/reports/1596673
Third Party Advisory
Issue Tracking
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq
Third Party Advisory