Medium severity · published Jul 12, 2021
CVE-2021-32689
Nextcloud Talk is a fully on-premises audio/video and chat communication service
6.5
CVSS
1%
EPSS
No
On KEV
Description
Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and 11.3.0. As a workaround, don't allow users to choose usernames themselves. This is the default behaviour of Nextcloud, but some user providers may allow doing so.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Talk · Nextcloud
before 11.2.2 · source: NVD
Affected product
TA
Talk
Nextcloud
More from Talk
9.9
CVE-2020-8180
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator
7.8
CVE-2023-39957
Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android
6.5
CVE-2021-32676
Nextcloud Talk is a fully on-premises audio/video and chat communication service
6.1
CVE-2022-24887
Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform
6.1
CVE-2021-41180
Nextcloud talk is a self hosting messaging service