CVE-2021-41181

Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone call the attacker could gain access to the chat messages and files of the user. It is recommended that the Nextcloud Android Talk App is upgraded to 12.3.0. There are no known workarounds.

CVSS v3 2.4 LOW
CVSS v2.0 2.1 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-497c-c8hx-6qcf	Third Party Advisory
https://github.com/nextcloud/talk-android/pull/1585	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nextcloud:talk:*:*:*:*:*:android:*:*

History

No history.

Information

Published : 2022-03-08 18:15

Updated : 2024-02-28 19:09

NVD link : CVE-2021-41181

Mitre link : CVE-2021-41181

CVE.ORG link : CVE-2021-41181

JSON object : View

Products Affected

nextcloud

talk

CWE

CWE-287

Improper Authentication

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2021-41181", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}]}, "published": "2022-03-08T18:15:07.807", "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-497c-c8hx-6qcf", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/talk-android/pull/1585", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone call the attacker could gain access to the chat messages and files of the user. It is recommended that the Nextcloud Android Talk App is upgraded to 12.3.0. There are no known workarounds."}, {"lang": "es", "value": "Nextcloud talk es un servicio de mensajer\u00eda autogestionado. En versiones anteriores a la 12.3.0 la aplicaci\u00f3n Nextcloud Android Talk no detectaba correctamente el estado de la pantalla de bloqueo cuando se recib\u00eda una llamada. Si un atacante consegu\u00eda acceder f\u00edsicamente al tel\u00e9fono bloqueado, y la v\u00edctima recib\u00eda una llamada, el atacante pod\u00eda acceder a los mensajes y archivos del chat del usuario. Se recomienda actualizar la aplicaci\u00f3n Nextcloud Android Talk a la versi\u00f3n 12.3.0. No se presentan medidas de mitigaci\u00f3n conocidas"}], "lastModified": "2022-10-24T16:42:07.740", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "E448479B-ADDE-438D-B1E7-387BECE94BAE", "versionEndExcluding": "12.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}