PT-2022-26156 · Nextcloud · Nextcloud Talk Android

Andyscherzinger · Published 2022-11-25 · Updated 2022-12-01 · CVE-2022-41926

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Talk Android versions prior to 14.1.0

Description The issue affects the Nextcloud Talk Android, which is the Android OS implementation of the Nextcloud Talk chat system. In affected versions, the receiver is not protected by broadcastPermission, allowing malicious apps to monitor communication.

Recommendations For versions prior to 14.1.0, upgrade to version 14.1.0 to resolve the issue. As a temporary workaround, consider restricting access to sensitive communication features until the upgrade is applied.

Exploit

Fix

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-200

CWE-732

Related Identifiers

CVE-2022-41926

GHSA-564V-3RFC-352M

Affected Products

Nextcloud Talk Android

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41926.json · Exploit
• https://github.com/nextcloud/talk-android/pull/2148 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41926 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41926 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-564v-3rfc-352m · Note
• https://t.me/cvenotify/38493 · Telegram Post
• https://hackerone.com/reports/1596459 · Note