4.3
CVE-2023-26041
- EPSS 0.19%
- Veröffentlicht 27.02.2023 21:15:12
- Zuletzt bearbeitet 21.11.2024 07:50:38
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginNextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured
Messages can still be seen on conversation after expiring when cron is misconfigured
Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk is upgraded to 15.0.3. There are no workaround available.
Mögliche Gegenmaßnahme
Talk: * No workaround available
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Nextcloud Talk Version >= 15.0.0 < 15.0.3
Weitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt
Talk
Version
>= 15.0.0, < 15.0.3
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.19% | 0.405 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
| security-advisories@github.com | 2.6 | 1.2 | 1.4 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
|
CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CWE-668 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.