Nextcloud Server up to 18.0.10/19.0.4/20.0.1 Markdown cross site scripting

entryeditHistoryDiffjsonxmlCTI

A vulnerability was found in Nextcloud Server up to 18.0.10/19.0.4/20.0.1 (Cloud Software). It has been rated as problematic. Affected by this issue is an unknown part of the component Markdown Handler. Upgrading to version 18.0.11, 19.0.5 or 20.0.2 eliminates this vulnerability.

Field02/04/2021 10:38 AM02/23/2021 01:00 PM
vendorNextcloudNextcloud
nameServerServer
version<=18.0.10/19.0.4/20.0.1<=18.0.10/19.0.4/20.0.1
componentMarkdown HandlerMarkdown Handler
cwe79 (cross site scripting)79 (cross site scripting)
risk11
cvss3_vuldb_avNN
cvss3_vuldb_acLL
cvss3_vuldb_uiRR
cvss3_vuldb_cNN
cvss3_vuldb_iLL
cvss3_vuldb_aNN
cvss3_vuldb_rlOO
cvss3_vuldb_rcCC
identifierhttps:/hackerone.com/reports/1023787https:/hackerone.com/reports/1023787
urlhttps://nextcloud.com/security/advisory/?id=NC-SA-2021-002https://nextcloud.com/security/advisory/?id=NC-SA-2021-002
nameUpgradeUpgrade
upgrade_version18.0.11/19.0.5/20.0.218.0.11/19.0.5/20.0.2
cveCVE-2020-8294CVE-2020-8294
date1612393200 (02/04/2021)1612393200 (02/04/2021)
typeCloud SoftwareCloud Software
cvss2_vuldb_avNN
cvss2_vuldb_acLL
cvss2_vuldb_ciNN
cvss2_vuldb_iiPP
cvss2_vuldb_aiNN
cvss2_vuldb_rcCC
cvss2_vuldb_rlOFOF
cvss2_vuldb_auSS
cvss2_vuldb_eNDND
cvss3_vuldb_prLL
cvss3_vuldb_sUU
cvss3_vuldb_eXX
cvss2_vuldb_basescore4.04.0
cvss2_vuldb_tempscore4.03.5
cvss3_vuldb_basescore3.53.5
cvss3_vuldb_tempscore3.53.4
cvss3_meta_basescore3.53.5
cvss3_meta_tempscore3.53.4
price_0day$0-$5k$0-$5k
cve_assigned1580166000
cve_nvd_summaryA missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.
confirm_urlhttps://hackerone.com/reports/1023787

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!