Medium severity4.3NVD Advisory· Published Apr 27, 2022· Updated Jun 17, 2026
CVE-2022-24887
CVE-2022-24887
Description
Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sharing a Deck card in conversation, the metaData can be manipulated so users can be tricked into opening arbitrary URLs. This issue is fixed in versions 11.3.4, 12.2.2, and 13.0.0. There are currently no known workarounds.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*range: <11.3.4
- cpe:2.3:a:nextcloud:talk:13.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:nextcloud:talk:13.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:nextcloud:talk:13.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:nextcloud:talk:13.0.0:rc4:*:*:*:*:*:*
- nextcloud/security-advisoriesv5Range: < 11.3.4
Patches
Vulnerability mechanics
References
3- github.com/nextcloud/spreed/pull/6410nvdPatchThird Party Advisory
- hackerone.com/reports/1358977nvdExploitThird Party Advisory
- github.com/nextcloud/security-advisories/security/advisories/GHSA-j45w-7mpq-264cnvdThird Party Advisory
News mentions
0No linked articles in our index yet.