CVE-2021-22878

CVE-2021-22878

EPSS 1.1%CWE-79

Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.

Affected products

n/a · Nextcloud Server

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/nextcloud/server/pull/25234 https://hackerone.com/reports/896522 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6BO6P6MP2MOWA6PZRXX32PLWPXN5O4S/https://nextcloud.com/security/advisory/?id=NC-SA-2021-005