CVEvulnerability
CVE-2019-15619
4.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-02-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
Affected configurations
• nextcloud deck (< 0.6.6)
• nextcloud nextcloud server (< 16.0.4)
• nextcloud talk (< 6.0.4)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://hackerone.com/reports/662204 Permissions Required
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-008 Vendor Advisory
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-009 Vendor Advisory
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-010 Vendor Advisory
- https://hackerone.com/reports/662204 Permissions Required
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-008 Vendor Advisory
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-009 Vendor Advisory
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-010 Vendor Advisory