CVE-2020-8180

moderate-risk
Published 2020-06-08

A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.

Do I need to act?

-
0.72% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: c0ec660107002c40816033ac703b9a5657303e9d, e1d9a241300d654301e65f5e9b13302e5abf3867, b14f9990b49673b44364a1a6fe2f830cbd56c1f9
9
CVSS 9.9/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Nextcloud

References (4)

Exploit https://hackerone.com/reports/851807
Vendor Advisory https://nextcloud.com/security/advisory/?id=NC-SA-2020-021
Exploit https://hackerone.com/reports/851807
Vendor Advisory https://nextcloud.com/security/advisory/?id=NC-SA-2020-021
40
/ 100
moderate-risk
Severity 33/34 · Critical
Exploitability 2/34 · Minimal
Exposure 5/34 · Minimal