CVE-2019-15619

published 2020-02-04

CVE-2019-15619: Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an…

Priority P4 18 medium 4.8 CVSS 3.1

AV N AC L PR H UI R S C C L I L A N

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
nextcloud	deck	< 0.6.6	0.6.6
nextcloud	nextcloud_server	< 16.0.4	16.0.4
nextcloud	nextcloud_server	—	—
nextcloud	talk	< 6.0.4	6.0.4

CVSS provenance

nvd v3.1 4.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79