CVE-2022-24890 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk
A call moderator can indirectly enable user webcams by granting permissions, exposing private video feeds to unauthorized actors.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-24890?
CVE-2022-24890 is a low-severity missing authorization vulnerability in nextcloud security-advisories, published on 17 May 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There are currently no known workarounds.
Which versions are affected by CVE-2022-24890?
It affects 1 product.
Products include Nextcloud Talk.
How do I fix CVE-2022-24890?
No fix has been published for CVE-2022-24890 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-24890 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24890 exists.
Other vulnerabilities in nextcloud security-advisories
- CVE-2020-8180 Code injection in Nextcloud Talk
- CVE-2021-32689 Nextcloud Talk not properly disassociating users from chats after account deletion
- CVE-2023-39957 Path traversal allows tricking the Talk Android app into writing files into it's root directory
- CVE-2021-32676 Session Fixation in Nextcloud Talk
- CVE-2021-39222 XSS in Talk
Sources
Also known as GHSA-vxpr-hcqq-7fw7.