CVE-2022-39332
published 2022-11-25CVE-2022-39332: Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via…
PriorityP427medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.92%
56.2th percentile
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nextcloud-desktop | < nextcloud-desktop 3.6.1-1 (bookworm) | nextcloud-desktop 3.6.1-1 (bookworm) |
| nextcloud | desktop | < 3.6.1 | 3.6.1 |
| nextcloud | security-advisories | < 3.6.1 | 3.6.1 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
osv5.4MEDIUM
vendor_debian4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Nextcloud Desktop up to 3.6.0 HTML HTML injection (GHSA-q9f6-4r6r-h74p / EUVD-2022-41809)
vuldb·2026-06-30·CVSS 5.4
CVE-2022-39332 [MEDIUM] Nextcloud Desktop up to 3.6.0 HTML HTML injection (GHSA-q9f6-4r6r-h74p / EUVD-2022-41809)
A vulnerability, which was classified as problematic, was found in Nextcloud Desktop up to 3.6.0. This affects an unknown function of the component HTML Handler. The manipulation results in HTML injection.
This vulnerability was named CVE-2022-39332. The attack may be performed from remote. There is no available exploit.
You should upgrade the affected component.
OSV
CVE-2022-39332: Nexcloud desktop is the Desktop sync client for Nextcloud
osv·2022-11-25·CVSS 5.4
CVE-2022-39332 [MEDIUM] CVE-2022-39332: Nexcloud desktop is the Desktop sync client for Nextcloud
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
Debian
CVE-2022-39332: nextcloud-desktop - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can injec...
vendor_debian·2022·CVSS 4.6
CVE-2022-39332 [MEDIUM] CVE-2022-39332: nextcloud-desktop - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can injec...
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
Scope: local
bookworm: resolved (fixed in 3.6.1-1)
bullseye: resolved (fixed in 3.1.1-2+deb11u2)
forky: resolved (fixed in 3.6.1-1)
sid: resolved (fixed in 3.6.1-1)
trixie: resolved (fixed in 3.6.1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/nextcloud/desktop/pull/4972https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q9f6-4r6r-h74phttps://hackerone.com/reports/1707977https://github.com/nextcloud/desktop/pull/4972https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q9f6-4r6r-h74phttps://hackerone.com/reports/1707977https://lists.debian.org/debian-lts-announce/2025/09/msg00018.html
2022-11-25
Published