CVE-2023-39957: Path traversal allows tricking the Talk Android app into writing files into it's root directory
Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. Prior to version 17.0.0, an unprotected intend allowed malicious third party apps to trick the Talk Android app into writing files outside of its intended cache directory. Nextcloud Talk Android version 17.0.0 has a patch for this issue. No known workarounds are available.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-39957?
CVE-2023-39957 is a vulnerability in Nextcloud Talk Android that allows malicious apps to write files outside of the intended cache directory.
How does CVE-2023-39957 affect Nextcloud Talk Android?
CVE-2023-39957 affects Nextcloud Talk Android by allowing malicious third-party apps to trick the app into writing files outside of its intended cache directory.
What is the severity of CVE-2023-39957?
CVE-2023-39957 has a severity rating of high with a score of 7.2.
How can I fix CVE-2023-39957 in Nextcloud Talk Android?
To fix CVE-2023-39957 in Nextcloud Talk Android, update the app to version 17.0.0 or higher.
Are there any references for CVE-2023-39957?
Yes, you can find references for CVE-2023-39957 at the following links: [GitHub Advisory](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-36f7-93f3-mcfj), [GitHub Pull Request](https://github.com/nextcloud/talk-android/pull/3064), [HackerOne Report](https://hackerone.com/reports/1997029).