CVE-2022-35932CWE-359

Missing rate limit when trying to join a password protected Nextcloud Talk conversation

Low · published August 12, 2022

CVSS v3.1
3.5
EPSS
1%
Percentile
71.6
In the wild
Unconfirmed
What it is

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is upgraded to 12.2.7, 13.0.7 or 14.0.3. There are currently no known workarounds available apart from not having password protected conversations.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01367 · 71.6th percentile
Weakness
CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2022-08-12T15:20Z
EPSS history
Timeline
  • 12 AUG 15:20Z
    Missing rate limit when trying to join a password protected Nextcloud Talk conversation
    cvelistv5