CVE-2023-45149

Password of talk conversations can be bruteforced in Nextcloud

CVSS 4.3 MEDIUMEPSS 0.5%CWE-307

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 4.3EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

16 oct 2023Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the Nextcloud Talk app is upgraded to 15.0.8, 16.0.6 or 17.1.1. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Productos afectados

nextcloud · security-advisories

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7rf8-pqmj-rpqv https://github.com/nextcloud/spreed/pull/10545 https://hackerone.com/reports/2094473