PT-2022-16961 · Nextcloud · Nextcloud Talk

Nickvergessen · Published 2022-05-17 · Updated 2022-05-26 · CVE-2022-24890

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Talk versions prior to 13.0.5 Nextcloud Talk versions prior to 14.0.0

Description The issue affects Nextcloud Talk, a video and audio conferencing app for Nextcloud. A call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions.

Recommendations For versions prior to 13.0.5, update to version 13.0.5 to resolve the issue. For versions prior to 14.0.0, update to version 14.0.0 to resolve the issue.

Exploit

Fix

Incorrect Default Permissions

Information Disclosure

Weakness Enumeration

CWE-359

CWE-276

CWE-200

Related Identifiers

CVE-2022-24890

GHSA-VXPR-HCQQ-7FW7

Affected Products

Nextcloud Talk

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24890.json · Exploit
• 🔥 https://github.com/nextcloud/spreed/issues/7048 · Exploit
• 🔥 https://github.com/nextcloud/spreed/pull/7034 · Exploit
• https://github.com/nextcloud/spreed/pull/7092 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24890 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24890 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vxpr-hcqq-7fw7 · Note
• https://t.me/cibsecurity/42851 · Telegram Post