CVE-2017-0890

Summary

Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Affected Software

Weaknesses

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

ADP Enrichment

CVE Program Container

Additional References

• https://hackerone.com/reports/213227
• https://nextcloud.com/security/advisory/?id=nc-sa-2017-007

References

• https://hackerone.com/reports/213227
• https://nextcloud.com/security/advisory/?id=nc-sa-2017-007

• ←Previous
• Next→