CVE-2023-39957
High
Description
Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. Prior to version 17.0.0, an unprotected intend allowed malicious third party apps to trick the Talk Android app into writing files outside of its intended cache directory. Nextcloud Talk Android version 17.0.0 has a patch for this issue. No known workarounds are available.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Nextcloud Talk
PublishedAug 10, 2023
First seenAug 10, 2023
Weakness typeCWE-22Path traversal
How to fix
Update
- nextcloud talk17.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nextcloud talk | v < 17.0.0, 17.0.0 | 17.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.