Nextcloud Talk prior 14.1.0 on Android permission assignment
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 3.8 | $0-$5k | 0.00 |
Summary
A vulnerability was found in Nextcloud Talk on Android. It has been declared as problematic. Affected by this issue is some unknown functionality. Executing a manipulation can lead to permission assignment. This vulnerability is tracked as CVE-2022-41926. The attack is restricted to local execution. No exploit exists. It is recommended to upgrade the affected component.
Details
A vulnerability has been found in Nextcloud Talk on Android (Android App Software) and classified as problematic. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a permission assignment vulnerability. The CWE definition for the vulnerability is CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. As an impact it is known to affect confidentiality. CVE summarizes:
Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that the Nextcloud Talk Android is upgraded to 14.1.0. There are no known workarounds for this issue.
The weakness was disclosed 11/26/2022 as GHSA-564v-3rfc-352m. The advisory is available at github.com. This vulnerability was named CVE-2022-41926 since 09/30/2022. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available.
Upgrading to version 14.1.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Product
Type
Vendor
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 3.9VulDB Meta Temp Score: 3.8
VulDB Base Score: 2.8
VulDB Temp Score: 2.7
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 5.5
NVD Vector: 🔍
CNA Base Score: 3.3
CNA Vector (GitHub, Inc.): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Permission assignmentCWE: CWE-732 / CWE-275 / CWE-266
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: Partially
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Talk 14.1.0
Patch: github.com
Timeline
09/30/2022 🔍11/26/2022 🔍
11/26/2022 🔍
12/23/2022 🔍
Sources
Advisory: GHSA-564v-3rfc-352mStatus: Confirmed
CVE: CVE-2022-41926 (🔍)
GCVE (CVE): GCVE-0-2022-41926
GCVE (VulDB): GCVE-100-214402
scip Labs: https://www.scip.ch/en/?labs.20130704
Entry
Created: 11/26/2022 08:03Updated: 12/23/2022 13:43
Changes: 11/26/2022 08:03 (51), 12/23/2022 13:43 (11)
Complete: 🔍
Cache ID: 216::103
If you want to get best quality of vulnerability data, you may have to visit VulDB.
No comments yet. Languages: en.
Please log in to comment.