CVE-2021-22878

CVE-2021-22878

EPSS 1.1%CWE-79

Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.

Produtos afetados

n/a · Nextcloud Server

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/nextcloud/server/pull/25234 https://hackerone.com/reports/896522 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6BO6P6MP2MOWA6PZRXX32PLWPXN5O4S/https://nextcloud.com/security/advisory/?id=NC-SA-2021-005