What’s Vulnerable › Vulnerabilities
CVE-2022-35932: Missing rate limit when trying to join a password protected Nextcloud Talk conversation
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-08-12 · updated 2026-06-17
- Weakness: CWE-359
Description
Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is upgraded to 12.2.7, 13.0.7 or 14.0.3. There are currently no known workarounds available apart from not having password protected conversations.
Affected products
- Nextcloud Talk: before 12.2.7; from 13.0.0 before 13.0.7; from 14.0.0 before 14.0.3 — fixed in 12.2.7, 13.0.7, 14.0.3
How to fix
Upgrade to a fixed version: Nextcloud Talk 12.2.7, 13.0.7, 14.0.3. Check the vendor advisory for mitigations.
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq
- https://github.com/nextcloud/spreed/commit/04300bbed0e87ff3420b5d752bbc48e2c15f35e9
- https://github.com/nextcloud/spreed/commit/10341b9fe59a44ae0d139c072abd6b5026f33771
- https://github.com/nextcloud/spreed/commit/f5ac73940f9f683b11e518d1c54150bf50dab9be
- https://github.com/nextcloud/spreed/pull/7504
- https://github.com/nextcloud/spreed/pull/7535
- https://github.com/nextcloud/spreed/pull/7536
- https://github.com/nextcloud/spreed/pull/7537
- https://hackerone.com/reports/1596673
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq
- https://github.com/nextcloud/spreed/commit/04300bbed0e87ff3420b5d752bbc48e2c15f35e9
- https://github.com/nextcloud/spreed/commit/10341b9fe59a44ae0d139c072abd6b5026f33771
Get alerted when CVE-2022-35932 or the next vulnerability affects your stack