Vulnerability Details : CVE-2022-35932
Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is upgraded to 12.2.7, 13.0.7 or 14.0.3. There are currently no known workarounds available apart from not having password protected conversations.
Products affected by CVE-2022-35932
- cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*
- cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*
- cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-35932
0.34%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 56 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-35932
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST | |
|
3.5
|
LOW | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N |
2.1
|
1.4
|
GitHub, Inc. |
CWE ids for CVE-2022-35932
-
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.Assigned by: nvd@nist.gov (Primary)
-
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.Assigned by: security-advisories@github.com (Secondary)
References for CVE-2022-35932
-
https://github.com/nextcloud/spreed/pull/7537
[stable22] Add brute force protection to conversation passwords by nickvergessen · Pull Request #7537 · nextcloud/spreed · GitHubIssue Tracking;Patch;Third Party Advisory
-
https://github.com/nextcloud/spreed/commit/f5ac73940f9f683b11e518d1c54150bf50dab9be
Merge pull request #7541 from nextcloud/changelog/12.2.7 · nextcloud/spreed@f5ac739 · GitHubPatch;Third Party Advisory
-
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq
Missing rate limit when trying to join a password protected Nextcloud Talk conversation · Advisory · nextcloud/security-advisories · GitHubIssue Tracking;Third Party Advisory
-
https://github.com/nextcloud/spreed/commit/04300bbed0e87ff3420b5d752bbc48e2c15f35e9
Merge pull request #7540 from nextcloud/changelog/12.2.7-13.0.7 · nextcloud/spreed@04300bb · GitHubPatch;Third Party Advisory
-
https://hackerone.com/reports/1596673
Nextcloud | Report #1596673 - Lack of Brute force protection while joining video call in talk section which is password protected | HackerOneIssue Tracking;Third Party Advisory
-
https://github.com/nextcloud/spreed/commit/10341b9fe59a44ae0d139c072abd6b5026f33771
Add changelog for 12.2.7, 13.0.7 and 14.0.3 · nextcloud/spreed@10341b9 · GitHubPatch;Release Notes;Third Party Advisory
-
https://github.com/nextcloud/spreed/pull/7504
Add brute force protection to conversation passwords by nickvergessen · Pull Request #7504 · nextcloud/spreed · GitHubIssue Tracking;Patch;Third Party Advisory
-
https://github.com/nextcloud/spreed/pull/7536
[stable23] Add brute force protection to conversation passwords by backportbot-nextcloud[bot] · Pull Request #7536 · nextcloud/spreed · GitHubIssue Tracking;Patch;Third Party Advisory
-
https://github.com/nextcloud/spreed/pull/7535
[stable24] Add brute force protection to conversation passwords by backportbot-nextcloud[bot] · Pull Request #7535 · nextcloud/spreed · GitHubIssue Tracking;Patch;Third Party Advisory
Jump to