Improper access control in Nextcloud Android Talk - CVE-2023-22473
Published: January 9, 2023
Vulnerability identifier: #VU70794
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-22473
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Nextcloud
Affected software:
Nextcloud Android Talk
Nextcloud Android Talk
Detailed vulnerability description
The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. An attacker with physical access can bypass of passcode and access the user's Nextcloud files and view conversations.
How to mitigate CVE-2023-22473
Install updates from vendor's website.