CVE-2019-15619

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
hackeroneCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
VendorProductVersion
nextclouddeck
𝑥
< 0.6.6
nextcloudnextcloud_server
𝑥
< 16.0.4
nextcloudtalk
𝑥
< 6.0.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://hackerone.com/reports/662204
https://nextcloud.com/security/advisory/?id=NC-SA-2020-008
https://nextcloud.com/security/advisory/?id=NC-SA-2020-009
https://nextcloud.com/security/advisory/?id=NC-SA-2020-010
https://hackerone.com/reports/662204
https://nextcloud.com/security/advisory/?id=NC-SA-2020-008
https://nextcloud.com/security/advisory/?id=NC-SA-2020-009
https://nextcloud.com/security/advisory/?id=NC-SA-2020-010