Improper Access Control Vulnerability in Nextcloud Talk by Nextcloud
CVE-2019-15620

2.7LOW

Key Information:

Vendor

Nextcloud
Status
Nextcloud Talk
Vendor
CVE Published:
4 February 2020

What is CVE-2019-15620?

An improper access control vulnerability in Nextcloud Talk version 6.0.3 can potentially expose the existence and names of private conversations when users link these conversations to other shared items using the projects feature. This could lead to unauthorized users gaining insights into sensitive discussions, highlighting the importance of securing access controls within collaborative applications.

Affected Version(s)

Nextcloud Talk 6.0.4

References

https://hackerone.com/reports/662218
x_refsource_MISC
https://nextcloud.com/security/advisory/?id=NC-SA-2020-011
x_refsource_MISC

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.