CVE-2025-53831highCWE-79

CVE-2025-53831: falha de alta gravidade em owncloud DrawIO for ownCloud

DrawIO for ownCloud 10 is vulnerable to Stored XSS

Publicada em

Seguir esta CVE+ Monitorar ownCloud 10+ Monitorar DrawIO for ownCloud

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.3%
DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage improper neutralization of input during web page generation to achieve stored XSS. Upgrade ownCloud 10 to version 10.15.3 or later or upgrade DrawIO for ownCloud 10 to version 1.0.2 or later to receive a patch.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Produtos afetados
owncloud · DrawIO for ownCloudowncloud · ownCloud 10
CVEs relacionadas — owncloud DrawIO for ownCloud

No mesmo produto, das mais perigosas para as menos.

CVE-2025-53829HIGHownCloud 10 is vulnerable to Relative Path TraversalEPSS 0.5%CVE-2025-53830CRITICALAnti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)EPSS 0.5%CVE-2025-53828HIGHSharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)EPSS 0.4%