Vulnerability Details : CVE-2022-41926
Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that the Nextcloud Talk Android is upgraded to 14.1.0. There are no known workarounds for this issue.
Vulnerability category: Information leak
Products affected by CVE-2022-41926
- cpe:2.3:a:nextcloud:talk:*:*:*:*:*:android:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-41926
0.03%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 5 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-41926
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
NIST | |
|
3.3
|
LOW | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
1.8
|
1.4
|
GitHub, Inc. |
CWE ids for CVE-2022-41926
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: security-advisories@github.com (Primary)
-
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.Assigned by: security-advisories@github.com (Primary)
References for CVE-2022-41926
-
https://github.com/nextcloud/talk-android/pull/2148
Use custom permission for unfiltered broadcast receiver in CallActivity by AlvaroBrey · Pull Request #2148 · nextcloud/talk-android · GitHubPatch;Third Party Advisory
-
https://hackerone.com/reports/1596459
HackerOnePermissions Required;Third Party Advisory
-
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-564v-3rfc-352m
Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate · Advisory · nextcloud/security-advisories · GitHubThird Party Advisory
Jump to