CVE-2022-24887: Open Redirect in Nextcloud Talk
Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sharing a Deck card in conversation, the metaData can be manipulated so users can be tricked into opening arbitrary URLs. This issue is fixed in versions 11.3.4, 12.2.2, and 13.0.0. There are currently no known workarounds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-24887?
CVE-2022-24887 is a vulnerability in Nextcloud Talk that allows the manipulation of metaData, tricking users into opening arbitrary URLs.
What is the severity of CVE-2022-24887?
CVE-2022-24887 has a severity rating of 6.1 (Medium).
Which versions of Nextcloud Talk are affected by CVE-2022-24887?
Prior to versions 11.3.4, 12.2.2, and 13.0.0, Nextcloud Talk is affected by CVE-2022-24887.
How can the vulnerability CVE-2022-24887 be fixed?
To fix CVE-2022-24887, users should update Nextcloud Talk to version 11.3.4, 12.2.2, or 13.0.0.
Are there any references for CVE-2022-24887?
Yes, you can find references for CVE-2022-24887 at the following URLs: [GitHub Advisory](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j45w-7mpq-264c), [GitHub Pull Request](https://github.com/nextcloud/spreed/pull/6410), [HackerOne Report](https://hackerone.com/reports/1358977).