CVE-2016-7419

EUVD-2016-8272
Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 41%
Affected Products (NVD)
VendorProductVersion
nextcloudnextcloud_server
𝑥
≤ 9.0.51
owncloudowncloud
𝑥
≤ 9.0.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/92373
https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc
https://hackerone.com/reports/145355
https://nextcloud.com/security/advisory/?id=nc-sa-2016-001
https://owncloud.org/security/advisory/?id=oc-sa-2016-011
http://www.securityfocus.com/bid/92373
https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc
https://hackerone.com/reports/145355
https://nextcloud.com/security/advisory/?id=nc-sa-2016-001
https://owncloud.org/security/advisory/?id=oc-sa-2016-011