Description (CNA)
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / Nextcloud Server | affected 16.0.4 |
CWE
CWE-79
References
- https://hackerone.com/reports/662204
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-008
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-009
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-010
ADP enrichment
No English description supplied.