CVE-2019-15619

EUVD-2019-6576
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
Affected Products (NVD)
VendorProductVersion
nextclouddeck
𝑥
< 0.6.6
nextcloudnextcloud_server
𝑥
< 16.0.4
nextcloudtalk
𝑥
< 6.0.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://hackerone.com/reports/662204
https://nextcloud.com/security/advisory/?id=NC-SA-2020-008
https://nextcloud.com/security/advisory/?id=NC-SA-2020-009
https://nextcloud.com/security/advisory/?id=NC-SA-2020-010
https://hackerone.com/reports/662204
https://nextcloud.com/security/advisory/?id=NC-SA-2020-008
https://nextcloud.com/security/advisory/?id=NC-SA-2020-009
https://nextcloud.com/security/advisory/?id=NC-SA-2020-010