CVE-2023-23942

EUVD-2023-28008

06.02.2023, 21:15

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.

Cross-site Scripting

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.4 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
GitHub_M	CNA	5.4 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 78%

Affected Products (NVD)

Vendor	Product	Version
nextcloud	desktop	𝑥 < 3.6.3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

nextcloud-desktop

bookworm	3.7.3-1+deb12u1 fixed
bullseye	no-dsa
bullseye (security)	vulnerable
buster	no-dsa
sid	3.15.0-1 fixed
trixie	3.15.0-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

nextcloud-desktop

bionic	dne
focal	needs-triage
jammy	needs-triage
kinetic	ignored
lunar	not-affected
mantic	not-affected
noble	not-affected
oracular	not-affected
trusty	dne
xenial	dne

Common Weakness Enumeration

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References

https://github.com/nextcloud/desktop/pull/5233

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-64qc-vf6v-8xgg

https://hackerone.com/reports/1788598

https://github.com/nextcloud/desktop/pull/5233

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-64qc-vf6v-8xgg

https://hackerone.com/reports/1788598