Information disclosure in Nextcloud Security-Advisories
CVE-2023-30540
Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has been patched in version 15.0.5 and it is recommended that users upgrad to 15.0.5. There are no known workarounds for this issue.
Vulnerability class: Information Disclosure
EPSS: 0.007 (47.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N.
Affected products
- Nextcloud Security-advisories — versions >= 15.0.0, < 15.0.5
- Nextcloud Talk
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Permissions Required, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-30540?
- CVE-2023-30540 is a low-severity vulnerability in Nextcloud Security-Advisories, classified under Information Disclosure. CVSS score: 3.5/10. Published 2023-04-17.
- How severe is CVE-2023-30540?
- Low severity. CVSS v3 base score is 3.5 out of 10.