POJIA破甲
地图 / Guests can continue to receive video streams from call after being removed from a conversation

Guests can continue to receive video streams from call after being removed from a conversation

信息泄露 / 隐私侵犯 / #1706248

厂商
Nextcloud
严重程度
低危 · CVSS 6.6
赏金
—
弱点
隐私侵犯
研究员
@daniel_calvino_sanchez
披露日期
2022-12-31
资产
nextcloud/spreed
CVE
CVE-2022-41971

该报告还没有中文解读。

原文摘录

摘自原文(1521 字符中的一小部分)
If the HPB is used and a guest is removed from a conversation while said guest is in a call the guest will no longer appear in the participant list and the call will appear as ended for the other participants. However, for the guest the call UI is still shown. If other participants start a call the …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @daniel_calvino_sanchez · 版权归作者与 Nextcloud 所有

同类报告

Physical Laptop TakeoverEd · 2018-08-12Connection informaton is sent to a third-party serviceNord Security · —Blocked user can see live videoTikTok · 2021-05-28 · $418Twitter ID exposure via error-based side-channel attackX / xAI · 2019-05-16 · $1,470Intent Leads To Unauthorised Video Call Initiation Leaking Surrounding Informations Of VictimSnapchat · 2024-04-05Changing email address on Twitter for Android unsets "Protect your Tweets"X / xAI · 2019-01-18 · $2,940