CVE-2023-28845: Chat room membership disclosed via autocompletion in Nextcloud talk
Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they themselves are not members. It is recommended that the Nextcloud Talk is upgraded to 14.0.9 or 15.0.4. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-28845?
CVE-2023-28845 is a vulnerability in the Nextcloud talk app that allows an attacker to gain information about the members of a conversation.
What is the severity of CVE-2023-28845?
CVE-2023-28845 has a severity rating of low.
How does CVE-2023-28845 affect Nextcloud talk?
CVE-2023-28845 affects Nextcloud talk versions 14.0.0 to 14.0.9 and versions 15.0.0 to 15.0.4.
How can an attacker exploit CVE-2023-28845?
An attacker can exploit CVE-2023-28845 to gain access to the member list of a Talk conversation.
Is there a fix available for CVE-2023-28845?
Yes, a fix for CVE-2023-28845 is available. Updating to a patched version of Nextcloud talk will resolve the vulnerability.