Nextcloud Talk Brute Force on Password Calls pre-12.2.7/13.0.7/14.0.3
CVE-2022-35932 Published on August 12, 2022
Missing rate limit when trying to join a password protected Nextcloud Talk conversation
Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is upgraded to 12.2.7, 13.0.7 or 14.0.3. There are currently no known workarounds available apart from not having password protected conversations.
Vulnerability Analysis
CVE-2022-35932 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is a Privacy violation Vulnerability?
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CVE-2022-35932 has been classified to as a Privacy violation vulnerability or weakness.
Products Associated with CVE-2022-35932
Want to know whenever a new CVE is published for Nextcloud Talk? stack.watch will email you.
Affected Versions
nextcloud security-advisories:- Version >= 12.2.0, < 12.2.7 is affected.
- Version >= 13.0.0, < 13.0.7 is affected.
- Version >= 14.0.0, < 14.0.3 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.