CVE-2020-8294

A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.
References
Link Resource
https://hackerone.com/reports/1023787 Permissions Required Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2021-002 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*

History

05 Feb 2021, 19:35

Type Values Removed Values Added
References (CONFIRM) https://hackerone.com/reports/1023787 - (CONFIRM) https://hackerone.com/reports/1023787 - Permissions Required, Third Party Advisory
References (CONFIRM) https://nextcloud.com/security/advisory/?id=NC-SA-2021-002 - (CONFIRM) https://nextcloud.com/security/advisory/?id=NC-SA-2021-002 - Vendor Advisory
CPE cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : 3.5
v3 : 5.4
CWE CWE-79

03 Feb 2021, 17:15

Type Values Removed Values Added
New CVE

Information

Published : 2021-02-03 17:15

Updated : 2023-12-10 13:41


NVD link : CVE-2020-8294

Mitre link : CVE-2020-8294

CVE.ORG link : CVE-2020-8294


JSON object : View

Products Affected

nextcloud

  • nextcloud_server
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')