CVE-2023-23942

06.02.2023, 21:15

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.

Cross-site Scripting

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.4 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
GitHub_M	CNA	5.4 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 73%

Vendor	Product	Version
nextcloud	desktop	𝑥 < 3.6.3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

nextcloud-desktop

bullseye (security)	vulnerable
bullseye	no-dsa
buster	no-dsa
bookworm	3.7.3-1+deb12u1 fixed
sid	3.15.0-1 fixed
trixie	3.15.0-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

nextcloud-desktop

oracular	not-affected
noble	not-affected
mantic	not-affected
lunar	not-affected
kinetic	ignored
jammy	needs-triage
focal	needs-triage
bionic	dne
xenial	dne
trusty	dne

Common Weakness Enumeration

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References

https://github.com/nextcloud/desktop/pull/5233

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-64qc-vf6v-8xgg

https://hackerone.com/reports/1788598

https://github.com/nextcloud/desktop/pull/5233

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-64qc-vf6v-8xgg

https://hackerone.com/reports/1788598