CVE-2022-35932

LOW

Nextcloud Talk <12.2.7, 13.0.7, 14.0.3 - Info Disclosure

Title source: llm
STIX 2.1

Description

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is upgraded to 12.2.7, 13.0.7 or 14.0.3. There are currently no known workarounds available apart from not having password protected conversations.

References (9)

Core 9
Core References
Issue Tracking, Third Party Advisory x_refsource_confirm
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/nextcloud/spreed/pull/7504
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/nextcloud/spreed/pull/7535
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/nextcloud/spreed/pull/7536
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/nextcloud/spreed/pull/7537
Issue Tracking, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1596673

Scores

CVSS v3 3.5
EPSS 0.0105
EPSS Percentile 59.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-359 CWE-307
Status published
Products (1)
nextcloud/talk < 12.2.7
Published Aug 12, 2022
Tracked Since Feb 18, 2026