PT-2022-23038 · Nextcloud · Nextcloud Talk

Errorsec · Published 2022-08-12 · Updated 2022-08-15 · CVE-2022-35932

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Talk versions prior to 12.2.7 Nextcloud Talk versions prior to 13.0.7 Nextcloud Talk versions prior to 14.0.3

Description Nextcloud Talk is a video and audio conferencing app for Nextcloud. Password protected conversations are susceptible to brute force attacks if the attacker has the link or conversation token.

Recommendations For versions prior to 12.2.7, upgrade to version 12.2.7. For versions prior to 13.0.7, upgrade to version 13.0.7. For versions prior to 14.0.3, upgrade to version 14.0.3. As a temporary workaround, consider not having password protected conversations until the issue is resolved.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-359

CWE-307

Related Identifiers

CVE-2022-35932

GHSA-PF36-JVPV-4HWQ

Affected Products

Nextcloud Talk

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35932.json · Exploit
• https://github.com/nextcloud/spreed/commit/04300bbed0e87ff3420b5d752bbc48e2c15f35e9 · Patch
• https://github.com/nextcloud/spreed/pull/7535 · Patch
• https://github.com/nextcloud/spreed/pull/7504 · Patch
• https://github.com/nextcloud/spreed/commit/f5ac73940f9f683b11e518d1c54150bf50dab9be · Patch
• https://github.com/nextcloud/spreed/pull/7536 · Patch
• https://github.com/nextcloud/spreed/pull/7537 · Patch
• https://github.com/nextcloud/spreed/commit/10341b9fe59a44ae0d139c072abd6b5026f33771 · Patch
• https://osv.dev/vulnerability/CVE-2022-35932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35932 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq · Note
• https://t.me/cibsecurity/48093 · Telegram Post
• https://hackerone.com/reports/1596673 · Note