A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HNextcloud Talk
APPNextcloud< 6.0.57.0.0 – 7.0.3 (bez)8.0.0 – 8.0.8 (bez)
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Powiązane podatności
CVE-2023-39957HIGH7.8ten sam produkt
Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. Prior to vers...
CVE-2021-32689HIGH8.1ten sam produkt
Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2,...
CVE-2023-45149MEDIUM4.3ten sam produkt
Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection...
CVE-2022-39212MEDIUM4.3ten sam produkt
Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected vers...
CVE-2022-24887MEDIUM4.3ten sam produkt
Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior...