Description

Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.

Related CPE's

a

nextcloud

nextcloud_server

Vulnerable

o

fedoraproject

fedora

34

Vulnerable

References

https://github.com/nextcloud/server/pull/25234

PatchThird Party Advisory

https://hackerone.com/reports/896522

ExploitIssue TrackingThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6BO6P6MP2MOWA6PZRXX32PLWPXN5O4S/

https://nextcloud.com/security/advisory/?id=NC-SA-2021-005

Vendor Advisory

Weaknesses

[email protected]

Primary
CWE-79

[email protected]

Secondary
CWE-79

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.8 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2021-03-03T18:15:14.817

4 years ago

Last modified

2023-11-07T03:30:27.327

1 year ago