PT-2023-20444 · Nextcloud · Nextcloud Talk

Ctulhu · Publicado 2023-02-27 · Atualizado 2023-03-08 · CVE-2023-26041

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Baixa

Vetor base

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Talk versions prior to 15.0.3

Description Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured, messages were not expired, and the API would still return them while they were hidden by the frontend code.

Recommendations For versions prior to 15.0.3, upgrade to version 15.0.3 to resolve the issue. As a temporary workaround, consider configuring cron jobs properly to expire messages, until a patch is available.

Exploit

Correção

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-359

CWE-668

Identificadores relacionados

CVE-2023-26041

GHSA-J53P-R755-V4JF

Produtos afetados

Nextcloud Talk

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26041.json · Exploit
• 🔥 https://hackerone.com/reports/1784310 · Exploit
• https://github.com/nextcloud/spreed/pull/8515 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j53p-r755-v4jf · Aviso do Fabricante
• https://t.me/cibsecurity/59073 · Publicação no Telegram
• https://t.me/cvenotify/45792 · Publicação no Telegram
• https://t.me/cvenotify/45107 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26041 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-26041 · Aviso do Fabricante