PT-2023-20444

CVE-2023-26041

Published

2023-02-27

Updated

2023-03-08

Description by

CVSS 3.1

2.6

Low

MetricsAV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Talk versions prior to 15.0.3

Description Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured, messages were not expired, and the API would still return them while they were hidden by the frontend code.

Recommendations For versions prior to 15.0.3, upgrade to version 15.0.3 to resolve the issue. As a temporary workaround, consider configuring cron jobs properly to expire messages, until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Ctulhu

Vendors

Affected products

Weakness enumeration

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

CWE-668: Exposure of Resource to Wrong Sphere

Related identifiers