CVE-2023-30540CWE-200

Chat poll data can still be queried from API after purging history in Nextcloud talk

Low · published April 17, 2023

CVSS v3.1
3.5
EPSS
1%
Percentile
50.8
In the wild
Unconfirmed
What it is

Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has been patched in version 15.0.5 and it is recommended that users upgrad to 15.0.5. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00656 · 50.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-04-17T21:32Z
EPSS history
Timeline
  • 17 APR 21:32Z
    Chat poll data can still be queried from API after purging history in Nextcloud talk
    cvelistv5