CVE-2022-24887CWE-601

Open Redirect in Nextcloud Talk

Medium · published April 27, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sharing a Deck card in conversation, the metaData can be manipulated so users can be tricked into opening arbitrary URLs. This issue is fixed in versions 11.3.4, 12.2.2, and 13.0.0. There are currently no known workarounds.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00938 · 60.5th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2022-04-27T13:55Z
EPSS history
Timeline
  • 27 APR 13:55Z
    Open Redirect in Nextcloud Talk
    cvelistv5