Improper access control in Nextcloud Android Talk - CVE-2023-22473

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU70794

Improper access control in Nextcloud Android Talk - CVE-2023-22473

Published: January 9, 2023


Vulnerability identifier: #VU70794
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-22473
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability: No public exploit available
Vulnerable software:
Nextcloud Android Talk
Software vendor:
Nextcloud

Description

The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. An attacker with physical access can bypass of passcode and access the user's Nextcloud files and view conversations.


Remediation

Install updates from vendor's website.

External links