Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, use a browser that has support for Content-Security-Policy.
References
| Link | Resource |
|---|---|
| https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x4w3-jhcr-57pq | Third Party Advisory |
| https://github.com/nextcloud/text/pull/1689 | Patch Third Party Advisory |
| https://hackerone.com/reports/1241460 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
14 Jul 2021, 15:27
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.1 |
| CWE | CWE-79 | |
| References | (CONFIRM) https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x4w3-jhcr-57pq - Third Party Advisory | |
| References | (MISC) https://github.com/nextcloud/text/pull/1689 - Patch, Third Party Advisory | |
| References | (MISC) https://hackerone.com/reports/1241460 - Permissions Required |
12 Jul 2021, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, use a browser that has support for Content-Security-Policy. |
12 Jul 2021, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-07-12 21:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-32733
Mitre link : CVE-2021-32733
CVE.ORG link : CVE-2021-32733
JSON object : View
Products Affected
nextcloud
- nextcloud_server
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')