Improper access control in Nextcloud Android Talk - CVE-2023-22473
Published: January 9, 2023
Vulnerability identifier: #VU70794
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-22473
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. An attacker with physical access can bypass of passcode and access the user's Nextcloud files and view conversations.
Affected software
Nextcloud Android Talk
How to mitigate CVE-2023-22473
Install updates from vendor's website.
Nextcloud Android Talk - update to 15.0.2