CVE-2022-24887
Last modified
CVE-2022-24887 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sharing a Deck card in conversation, the metaData can be manipulated so users can be tricked into opening arbitrary URLs. EPSS estimates a 0.90% chance of exploitation in the next 30 days.
Description
Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sharing a Deck card in conversation, the metaData can be manipulated so users can be tricked into opening arbitrary URLs. This issue is fixed in versions 11.3.4, 12.2.2, and 13.0.0. There are currently no known workarounds.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Nextcloud | Talk | < 11.3.4 | — |
| Nextcloud | Talk | >= 12.0.0, < 12.2.4 | — |
| Nextcloud | Talk | 13.0.0 | Rc1 |
References
- https://github.com/nextcloud/spreed/pull/6410Patch, Third Party Advisory
- https://hackerone.com/reports/1358977Exploit, Third Party Advisory
- https://github.com/nextcloud/spreed/pull/6410Patch, Third Party Advisory
- https://hackerone.com/reports/1358977Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-24887?
How severe is CVE-2022-24887?
How do I fix CVE-2022-24887?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-24881Ballcat Codegen provides the function of online editing code…9.8
- CVE-2022-24882FreeRDP is a free implementation of the Remote Desktop Proto…7.5
- CVE-2022-24883FreeRDP is a free implementation of the Remote Desktop Proto…9.8
- CVE-2022-24884ecdsautils is a tiny collection of programs used for ECDSA (…7.5
- CVE-2022-24885Nextcloud Android app is the Android client for Nextcloud, a…2.4
- CVE-2022-24886Nextcloud Android app is the Android client for Nextcloud, a…3.8
- CVE-2022-24888Nextcloud Server is the file server software for Nextcloud, …4.3
- CVE-2022-24889Nextcloud Server is the file server software for Nextcloud, …4.3
- CVE-2022-2489A vulnerability was found in SourceCodester Simple E-Learnin…8.8
- CVE-2022-24890Nextcloud Talk is a video and audio conferencing app for Nex…4.3
- CVE-2022-24891ESAPI (The OWASP Enterprise Security API) is a free, open so…6.1
- CVE-2022-24892Shopware is an open source e-commerce software platform. Sta…7.5
Are you affected by CVE-2022-24887?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST