Vulnerability Details : CVE-2022-41971
Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to see videos on a call in a public conversation after being removed from that conversation, provided that they were removed while being in the call. Versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0 contain patches for the issue. No known workarounds are available.
Vulnerability category: Information leak
Products affected by CVE-2022-41971
- cpe:2.3:a:nextcloud:nextcloud_talk:*:*:*:*:*:android:*:*
- cpe:2.3:a:nextcloud:nextcloud_talk:*:*:*:*:*:android:*:*
- cpe:2.3:a:nextcloud:nextcloud_talk:*:*:*:*:*:android:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-41971
0.12%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 32 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-41971
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST | |
|
4.8
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N |
1.2
|
3.6
|
GitHub, Inc. |
CWE ids for CVE-2022-41971
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: security-advisories@github.com (Secondary)
-
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.Assigned by: security-advisories@github.com (Secondary)
-
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-41971
-
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wx6w-xpg9-6fv4
Guests can continue to receive video streams from call after being removed from a conversation · Advisory · nextcloud/security-advisories · GitHubThird Party Advisory
-
https://github.com/nextcloud/spreed/pull/7974
Fix participant sessions not sent to the HPB by danxuliu · Pull Request #7974 · nextcloud/spreed · GitHubThird Party Advisory
-
https://hackerone.com/reports/1706248
HackerOnePermissions Required;Third Party Advisory
Jump to