CVE-2022-39212 Last video frame is still sent after video is disabled in a call in Nextcloud Talk
Attackers can view the last video frame of participants who disabled video but kept a camera selected, exposing sensitive visual data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-39212?
CVE-2022-39212 is a medium-severity vulnerability in nextcloud security-advisories, published on 16 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected versions an attacker could see the last video frame of any participant who has video disabled but a camera selected. It is recommended that the Nextcloud Talk app is upgraded to 13.0.8 or 14.0.4. Users unable to upgrade should select "None" as camera before joining the call.
Weakness: CWE-200
Which versions are affected by CVE-2022-39212?
It affects 1 product.
Products include Nextcloud Talk.
How do I fix CVE-2022-39212?
No fix has been published for CVE-2022-39212 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-39212 being exploited?
There is no known exploitation of CVE-2022-39212 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2020-8180 Code injection in Nextcloud Talk
- CVE-2021-32689 Nextcloud Talk not properly disassociating users from chats after account deletion
- CVE-2023-39957 Path traversal allows tricking the Talk Android app into writing files into it's root directory
- CVE-2021-32676 Session Fixation in Nextcloud Talk
- CVE-2021-39222 XSS in Talk
Sources
Also known as GHSA-wq3g-2x46-q2gv.