Vulnerability CVE-2021-41180


Published: 2022-03-08

Description:
Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only affected users of the Android Talk client. It is recommended that the Nextcloud Talk App is upgraded to 12.1.2. There are no known workarounds.

Type:

CWE-601

(URL Redirection to Untrusted Site ('Open Redirect'))

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
4.9/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None
Affected software
Nextcloud -> TALK 

 References:
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4fxr-mrw2-cq92
https://github.com/nextcloud/spreed/pull/6239
https://hackerone.com/reports/1337178

Copyright 2024, cxsecurity.com

 

Back to Top