Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, use a browser that has support for Content-Security-Policy.
References
| Link | Resource |
|---|---|
| https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x4w3-jhcr-57pq | Third Party Advisory |
| https://github.com/nextcloud/text/pull/1689 | Patch Third Party Advisory |
| https://hackerone.com/reports/1241460 | Permissions Required |
| https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x4w3-jhcr-57pq | Third Party Advisory |
| https://github.com/nextcloud/text/pull/1689 | Patch Third Party Advisory |
| https://hackerone.com/reports/1241460 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x4w3-jhcr-57pq - Third Party Advisory | |
| References | () https://github.com/nextcloud/text/pull/1689 - Patch, Third Party Advisory | |
| References | () https://hackerone.com/reports/1241460 - Permissions Required | |
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 4.8 |
Information
Published : 2021-07-12 21:15
Updated : 2024-11-21 06:07
NVD link : CVE-2021-32733
Mitre link : CVE-2021-32733
CVE.ORG link : CVE-2021-32733
JSON object : View
Products Affected
nextcloud
- nextcloud_server
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')