CVE-2016-7419

Опубликовано: 17 сент. 2016

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.

Ссылки

http://www.securityfocus.com/bid/92373
https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc
Patch
https://hackerone.com/reports/145355
Exploit
Mailing List
Third Party Advisory
https://nextcloud.com/security/advisory/?id=nc-sa-2016-001
Vendor Advisory
https://owncloud.org/security/advisory/?id=oc-sa-2016-011
Vendor Advisory
http://www.securityfocus.com/bid/92373
https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc
Patch
https://hackerone.com/reports/145355
Exploit
Mailing List
Third Party Advisory
https://nextcloud.com/security/advisory/?id=nc-sa-2016-001
Vendor Advisory
https://owncloud.org/security/advisory/?id=oc-sa-2016-011
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*

Версия до 9.0.51 (включая)

cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*

Версия до 9.0.3 (включая)

EPSS

Процентиль: 43%

0.00199

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2016-7419

CVSS3: 5.4

debian

почти 9 лет назад

Cross-site scripting (XSS) vulnerability in share.js in the gallery ap ...

GHSA-83x5-hc36-mfm2

CVSS3: 5.4

github

около 3 лет назад

EPSS

Процентиль: 43%

0.00199

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79