CVE-2023-45149

Published: Oct 16, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the Nextcloud Talk app is upgraded to 15.0.8, 16.0.6 or 17.1.1. There are no known workarounds for this vulnerability.

Affected (3)

Products: Nextcloud: Talk

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Talk	From 15.0.0 to 15.0.8
Nextcloud Talk	From 16.0.0 to 16.0.6
Nextcloud Talk	From 17.0.0 to 17.1.1

Related CWEs

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (6)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7rf8-pqmj-rpqv

Source: security-advisories@github.com

Vendor Advisory

https://github.com/nextcloud/spreed/pull/10545

Source: security-advisories@github.com

Issue TrackingPatch

https://hackerone.com/reports/2094473

Source: security-advisories@github.com

Permissions Required

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7rf8-pqmj-rpqv

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/nextcloud/spreed/pull/10545

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://hackerone.com/reports/2094473

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

Timeline

No history available yet.