CVE-2018-3781 — Cross-site Scripting in Talk

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.4%
top 39.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nextcloud TalkNextcloud Talk
Timeline
PublishedAug 13
Latest updateMay 13

Description

A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶NVDnextcloud/talk< 3.2.5
▶CVEListV5nextcloud/nextcloud_talk>=3.2.5

🔴Vulnerability Details

2
GHSA
GHSA-86ww-pfxr-g767: A missing sanitization of search results for an autocomplete field in NextCloud Talk <3↗2022-05-13
▶
CVEList
CVE-2018-3781: A missing sanitization of search results for an autocomplete field in NextCloud Talk <3↗2018-08-13
▶
CVE-2018-3781 — Cross-site Scripting in Nextcloud Talk | cvebase