CVE-2020-8180: Code Injection
Published Jun 8, 2020
·Updated
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.
Affected Software
3 affected components
NextCloud Talk<6.0.5
NextCloud Talk>=7.0.0<7.0.3
NextCloud Talk>=8.0.0<8.0.8
Remediation
Patch Available
Event History
Jun 8, 2020
CVE Published
via MITRE·01:08 PM
Data Sourced
via MITRE·01:08 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-8180.
2
What is the severity of CVE-2020-8180?
The severity of CVE-2020-8180 is critical.
3
What software versions are affected by CVE-2020-8180?
Nextcloud Talk versions 6.0.4, 7.0.2, 7.0.0 to 7.0.3, 8.0.0 to 8.0.7, and 8.0.0 to 8.0.7 are affected by CVE-2020-8180.
4
What is the CWE ID for CVE-2020-8180?
The CWE ID for CVE-2020-8180 is 94.
5
How can I fix CVE-2020-8180?
To fix CVE-2020-8180, it is recommended to update Nextcloud Talk to version 6.0.5, 7.0.4, or 8.0.8 or later.