CVE-2021-39222 — Cross-site Scripting in Security-advisories

CWE-79 — Cross-site ScriptingCWE-434 — Unrestricted File Upload2 documents2 sources
Severity
6.1MEDIUMNVD
CNA6.4
EPSS
0.4%
top 37.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nextcloud Security-advisoriesNextcloud Talk
Timeline
PublishedNov 15

Description

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Talk application is upgraded to patched versions…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5nextcloud/security-advisories< 10.0.7+4
▶NVDnextcloud/talk10.1.0 — 10.1.4+2

🔴Vulnerability Details

1
CVEList
XSS in Talk↗2021-11-15
▶
CVE-2021-39222 — Cross-site Scripting | cvebase