CVE-2017-0890 — Cross-site Scripting in Server

CWE-79 — Cross-site Scripting9 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
0.3%
top 51.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Nextcloud Server
Timeline
PublishedMay 8
Latest updateMay 13

Description

Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5nextcloud/nextcloud_serverbefore 11.0.3

Patches

Patch: nextcloud.com ↗Patch: nextcloud.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-pv3c-r8vx-j8wm: Nextcloud Server before 11↗2022-05-13
▶
CVEList
CVE-2017-0890: Nextcloud Server before 11↗2017-05-08
▶

💬Community

6
HackerOne
DOM XSS vulnerability in search dialogue (NC-SA-2017-007)↗2017-06-07
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 owncloud: nextcloud: Multiple security issues [epel-7]↗2017-05-16
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 owncloud: nextcloud: Multiple security issues [fedora-all]↗2017-05-16
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 nextcloud: Multiple security issues [fedora-all]↗2017-05-09
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 nextcloud: Multiple security issues [epel-7]↗2017-05-09
▶
CVE-2017-0890 — Cross-site Scripting in Server | cvebase