exploitDog

CVE-2021-22878

Опубликовано: 03 мар. 2021

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in OC.Notification.show.

Ссылки

https://github.com/nextcloud/server/pull/25234
Patch
Third Party Advisory
https://hackerone.com/reports/896522
Exploit
Issue Tracking
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6BO6P6MP2MOWA6PZRXX32PLWPXN5O4S/
https://nextcloud.com/security/advisory/?id=NC-SA-2021-005
Vendor Advisory
https://github.com/nextcloud/server/pull/25234
Patch
Third Party Advisory
https://hackerone.com/reports/896522
Exploit
Issue Tracking
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6BO6P6MP2MOWA6PZRXX32PLWPXN5O4S/
https://nextcloud.com/security/advisory/?id=NC-SA-2021-005
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*

Версия до 20.0.6 (исключая)

Конфигурация 2

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

EPSS

Процентиль: 58%

0.00368

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

CWE-79

Связанные уязвимости

CVE-2021-22878

CVSS3: 4.8

debian

больше 4 лет назад

Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site ...

GHSA-3qm7-9jrc-h4gp

github

около 3 лет назад

Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.

EPSS

Процентиль: 58%

0.00368

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

CWE-79