CVE-2022-39212CWE-200

Last video frame is still sent after video is disabled in a call in Nextcloud Talk

Medium · published September 16, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
51.9
In the wild
Unconfirmed
What it is

Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected versions an attacker could see the last video frame of any participant who has video disabled but a camera selected. It is recommended that the Nextcloud Talk app is upgraded to 13.0.8 or 14.0.4. Users unable to upgrade should select "None" as camera before joining the call.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00683 · 51.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-09-16T23:15Z
EPSS history
Timeline
  • 16 SEP 23:15Z
    Last video frame is still sent after video is disabled in a call in Nextcloud Talk
    cvelistv5