CVE-2023-45149: Password of talk conversations can be bruteforced in Nextcloud

Q: What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2023-45149.

Q: What is the title of this vulnerability?

The title of this vulnerability is 'Nextcloud talk brute force protection bypass'.

Q: What is the severity of CVE-2023-45149?

The severity of CVE-2023-45149 is medium.

Q: How can I fix the Nextcloud talk brute force protection bypass vulnerability?

To fix the Nextcloud talk brute force protection bypass vulnerability, update Nextcloud talk to a version that is not affected.

Published Oct 16, 2023

Updated

Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the Nextcloud Talk app is upgraded to 15.0.8, 16.0.6 or 17.1.1. There are no known workarounds for this vulnerability.

Affected Software

3 affected components

NextCloud Talk>=15.0.0<15.0.8

NextCloud Talk>=16.0.0<16.0.6

NextCloud Talk>=17.0.0<17.1.1

Remediation

Patch Available

https://github.com/nextcloud/spreed/pull/10545

Event History

Oct 16, 2023

CVE Published

via MITRE·07:03 PM

Data Sourced

via MITRE·07:03 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2023-45149.

What is the title of this vulnerability?

The title of this vulnerability is 'Nextcloud talk brute force protection bypass'.

What is Nextcloud talk?

Nextcloud talk is a chat module for the Nextcloud server platform.

What is the severity of CVE-2023-45149?