CVE-2016-7419 — Cross-site Scripting in Server

CWE-79 — Cross-site Scripting6 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
0.2%
top 57.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nextcloud ServerOwncloud
Timeline
PublishedSep 17
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-83x5-hc36-mfm2: Cross-site scripting (XSS) vulnerability in share↗2022-05-17
▶
CVEList
CVE-2016-7419: Cross-site scripting (XSS) vulnerability in share↗2016-09-17
▶

💬Community

3
Bugzilla
CVE-2016-7419 owncloud: Stored XSS in gallery application↗2016-09-19
▶
Bugzilla
CVE-2016-7419 owncloud: Stored XSS in gallery application [epel-all]↗2016-09-19
▶
Bugzilla
CVE-2016-7419 owncloud: Stored XSS in gallery application [fedora-all]↗2016-09-19
▶
CVE-2016-7419 — Cross-site Scripting in Server | cvebase