CVE-2018-3764
N/A
N/A
Summary
In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Nextcloud | Nextcloud Contacts application | <2.1.2 | affected |
Weaknesses
- CWE-79: Cross-site Scripting (XSS) - Stored (CWE-79)
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.