PT-2022-11372 · Nextcloud · Nextcloud Talk Android

Nickvergessen · Published 2022-03-08 · Updated 2022-10-24 · CVE-2021-41181

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Android Talk App versions prior to 12.3.0

Description Nextcloud talk is a self-hosting messaging service. The Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone call, the attacker could gain access to the chat messages and files of the user.

Recommendations For versions prior to 12.3.0, it is recommended that the Nextcloud Android Talk App is upgraded to 12.3.0. At the moment, there are no known workarounds for this issue.

Fix

Improper Authentication

Information Disclosure

Weakness Enumeration

CWE-287

CWE-200

Related Identifiers

CVE-2021-41181

GHSA-497C-C8HX-6QCF

Affected Products

Nextcloud Talk Android

References · 8

• https://github.com/nextcloud/talk-android/pull/1585 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41181 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41181 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-497c-c8hx-6qcf · Note
• https://t.me/cvenotify/27909 · Telegram Post
• https://t.me/cvenotify/27921 · Telegram Post
• https://t.me/cibsecurity/38543 · Telegram Post
• https://t.me/cvenotify/28134 · Telegram Post