CVE-2023-39957

Katalog CVE

CVSS 7.8 · High EPSS 0,37%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada nextcloud talk. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. Prior to version 17.0.0, an unprotected intend allowed malicious third party apps to trick the Talk Android app into writing files outside of its intended cache directory. Nextcloud Talk Android version 17.0.0 has a patch for this issue. No known workarounds are available.

Rincian

Terbit di NVD

10 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-36f7-93f3-mcfj patch · advisory vendor
• https://github.com/nextcloud/talk-android/pull/3064 patch
• https://hackerone.com/reports/1997029 issue tracking · advisory pihak ketiga