Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-15619

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.

Published

2020-02-04T20:15:12.340

Last Modified

2024-11-21T04:29:08.627

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: SINGLE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

6.8

Impact Score

2.9

Weaknesses

Type: Secondary
CWE-79
Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	nextcloud	deck	< 0.6.6	Yes
Application	nextcloud	nextcloud_server	< 16.0.4	Yes
Application	nextcloud	talk	< 6.0.4	Yes

References

https://hackerone.com/reports/662204 Permissions Required ([email protected])
https://nextcloud.com/security/advisory/?id=NC-SA-2020-008 Vendor Advisory ([email protected])
https://nextcloud.com/security/advisory/?id=NC-SA-2020-009 Vendor Advisory ([email protected])
https://nextcloud.com/security/advisory/?id=NC-SA-2020-010 Vendor Advisory ([email protected])
https://hackerone.com/reports/662204 Permissions Required (af854a3a-2127-422b-91ae-364da2661108)
https://nextcloud.com/security/advisory/?id=NC-SA-2020-008 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://nextcloud.com/security/advisory/?id=NC-SA-2020-009 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://nextcloud.com/security/advisory/?id=NC-SA-2020-010 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)