CVE-2022-39331

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.6 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
GitHub_MCNA
4.6 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
VendorProductVersion
nextclouddesktop
𝑥
< 3.6.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nextcloud-desktop
bullseye (security)
vulnerable
bullseye
no-dsa
buster
no-dsa
bookworm
3.7.3-1+deb12u1
fixed
sid
3.13.2-2
fixed
trixie
3.13.2-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nextcloud-desktop
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
focal
needs-triage
bionic
dne
xenial
ignored
trusty
ignored
Common Weakness Enumeration
References
https://github.com/nextcloud/desktop/pull/4944
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c3xh-q694-6rc5
https://hackerone.com/reports/1668028
https://github.com/nextcloud/desktop/pull/4944
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c3xh-q694-6rc5
https://hackerone.com/reports/1668028