CVE-2022-39331
published 2022-11-25CVE-2022-39331: Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in…
PriorityP427medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.90%
55.6th percentile
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nextcloud-desktop | < nextcloud-desktop 3.6.1-1 (bookworm) | nextcloud-desktop 3.6.1-1 (bookworm) |
| nextcloud | desktop | < 3.6.1 | 3.6.1 |
| nextcloud | security-advisories | < 3.6.1 | 3.6.1 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
osv5.4MEDIUM
vendor_debian4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Nexcloud Desktop up to 3.6.0 cross site scripting (GHSA-c3xh-q694-6rc5 / EUVD-2022-41808)
vuldb·2026-06-30·CVSS 5.4
CVE-2022-39331 [MEDIUM] Nexcloud Desktop up to 3.6.0 cross site scripting (GHSA-c3xh-q694-6rc5 / EUVD-2022-41808)
A vulnerability, which was classified as problematic, has been found in Nexcloud Desktop up to 3.6.0. The impacted element is an unknown function. The manipulation leads to cross site scripting.
This vulnerability is uniquely identified as CVE-2022-39331. The attack is possible to be carried out remotely. No exploit exists.
It is advisable to upgrade the affected component.
OSV
CVE-2022-39331: Nexcloud desktop is the Desktop sync client for Nextcloud
osv·2022-11-25·CVSS 5.4
CVE-2022-39331 [MEDIUM] CVE-2022-39331: Nexcloud desktop is the Desktop sync client for Nextcloud
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
Debian
CVE-2022-39331: nextcloud-desktop - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can injec...
vendor_debian·2022·CVSS 4.6
CVE-2022-39331 [MEDIUM] CVE-2022-39331: nextcloud-desktop - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can injec...
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
Scope: local
bookworm: resolved (fixed in 3.6.1-1)
bullseye: resolved (fixed in 3.1.1-2+deb11u2)
forky: resolved (fixed in 3.6.1-1)
sid: resolved (fixed in 3.6.1-1)
trixie: resolved (fixed in 3.6.1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/nextcloud/desktop/pull/4944https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c3xh-q694-6rc5https://hackerone.com/reports/1668028https://github.com/nextcloud/desktop/pull/4944https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c3xh-q694-6rc5https://hackerone.com/reports/1668028https://lists.debian.org/debian-lts-announce/2025/09/msg00018.html
2022-11-25
Published