Missing rate limit when trying to join a password protected Nextcloud Talk conversation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-359 and CWE-307.
Summary
Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is upgraded to 12.2.7, 13.0.7 or 14.0.3. There are currently no known workarounds available apart from not having password protected conversations.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | 12.2.0 to before 12.2.7; 13.0.0 to before 13.0.7; 14.0.0 to before 14.0.3 | 12.2.7, 13.0.7, 14.0.3 | Patch available | CNA |
- security-advisories Vendornextcloud Affected 12.2.0 to before 12.2.7; 13.0.0 to before 13.0.7; 14.0.0 to before 14.0.3 Fixed in 12.2.7, 13.0.7, 14.0.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:* | before 12.2.7; 13.0.0 to before 13.0.7; 14.0.0 to before 14.0.3 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:* Versions before 12.2.7; 13.0.0 to before 13.0.7; 14.0.0 to before 14.0.3 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 12.2.7, 13.0.7, 14.0.3
Timeline
- 2026-10-02 Threatist record created from CVE-2022-35932
References
Patch 7
- https://github.com/nextcloud/spreed/pull/7504
- https://github.com/nextcloud/spreed/pull/7535
- https://github.com/nextcloud/spreed/pull/7536
- https://github.com/nextcloud/spreed/pull/7537
- https://github.com/nextcloud/spreed/commit/04300bbed0e87ff3420b5d752bbc48e2c15f35e9
- https://github.com/nextcloud/spreed/commit/10341b9fe59a44ae0d139c072abd6b5026f33771
- https://github.com/nextcloud/spreed/commit/f5ac73940f9f683b11e518d1c54150bf50dab9be
More nextcloud Talk vulnerabilities
- TI-2022-08697 Open Redirect in Nextcloud Talk CVSS 3.1MEDIUM 6.1
- TI-2021-18019 Geolocation preview links can be set to arbitrary links in nextcloud talk CVSS 3.1MEDIUM 6.1
- TI-2023-24170 Password of talk conversations can be bruteforced in Nextcloud CVSS 3.1MEDIUM 4.3
- TI-2022-08700 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk CVSS 3.1MEDIUM 4.3
- TI-2020-06598 Code injection in Nextcloud Talk CVSS 3.1CRITICAL 9.9
- TI-2023-08722 Passcode bypass on Talk-Android app CVSS 3.1LOW 2.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences