PT-2023-27173 · Nextcloud · Nextcloud Talk Android

Ch0Pin · Publicado 2023-08-10 · Atualizado 2023-08-16 · CVE-2023-39957

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nextcloud Talk Android versions prior to 17.0.0

Description Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. An unprotected intent in versions prior to 17.0.0 allowed malicious third-party apps to trick the Talk Android app into writing files outside of its intended cache directory.

Recommendations For versions prior to 17.0.0, update to version 17.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the app's cache directory until the update is applied.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-39957

GHSA-36F7-93F3-MCFJ

Produtos afetados

Nextcloud Talk Android

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39957.json · Exploit
• https://github.com/nextcloud/talk-android/pull/3064 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-36f7-93f3-mcfj · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1689710879770583040 · Publicação no Twitter
• https://t.me/cvenotify/56202 · Publicação no Telegram
• https://hackerone.com/reports/1997029 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-39957 · Nota de Segurança
• https://t.me/cibsecurity/68237 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-39957 · Aviso do Fabricante