CVE-2023-28845 : What You Need to Know

This CVE, assigned on March 24, 2023, and published on March 31, 2023, highlights a vulnerability in Nextcloud Talk, an application known for video and audio conferencing within the Nextcloud ecosystem. The vulnerability could allow unauthorized disclosure of chat room membership information through autocompletion features.

Understanding CVE-2023-28845

Nextcloud Talk, a video and audio conferencing app, is impacted by a security flaw that allows unauthorized users to access information about the members of a Talk conversation. This vulnerability can be exploited even by individuals who are not part of the conversation themselves.

What is CVE-2023-28845?

CVE-2023-28845 is classified under CWE-284 (Improper Access Control) and is rated with a CVSSv3.1 base score of 3.5, indicating a low severity level. The attack complexity is rated as low, requiring network access and user interaction.

The Impact of CVE-2023-28845

The impact of this vulnerability is considered low in terms of confidentiality and integrity. While no immediate availability impact is reported, unauthorized access to chat room membership information can lead to privacy concerns and potential exploitation of sensitive data.

Technical Details of CVE-2023-28845

The vulnerability in Nextcloud Talk arises from improper access control within the application.

Vulnerability Description

In affected versions of Nextcloud Talk, the app fails to adequately filter access to the members' list of a chat conversation. This oversight can be leveraged by attackers to gather information about chat room members, even without being part of the chat themselves.

Affected Systems and Versions

Versions of Nextcloud Talk affected by this vulnerability include:

Nextcloud Talk >= 15.0.0 and < 15.0.4
Nextcloud Talk >= 14.0.0 and < 14.0.9

Exploitation Mechanism

Exploiting this vulnerability requires the attacker to interact with the network and the application, posing a risk to the confidentiality of chat room membership information.

Mitigation and Prevention

To mitigate the risks associated with CVE-2023-28845, immediate action is recommended.

Immediate Steps to Take

Upgrade Nextcloud Talk to version 14.0.9 or 15.0.4 to address the vulnerability.
Implement security best practices in user access control and authentication mechanisms to prevent unauthorized access.

Long-Term Security Practices

Regularly update and patch Nextcloud Talk to ensure that security vulnerabilities are addressed promptly.
Conduct security audits and assessments to identify and mitigate potential access control issues within the application.