Skip to content
OpenAdvisories
Low WID-SEC-2023-0290 3 CVEs

Nextcloud: Mehrere Schwachstellen

Published Feb 5, 2023 · Updated Feb 5, 2023 · de-DE

Vendor: Nextcloud Product: Nextcloud Product: Nextcloud desktop Client < 3.6.3 Product: Nextcloud mail < 1.15.0 Product: Nextcloud mail < 2.2.2 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Nextcloud bezüglich des Desktop-Clients und der Mail-Komponente ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder Informationen offenzulegen.

Product

Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit.

Vulnerabilities 3

  • Medium 5.4
    CVE-2023-23942

    Self reflected HTML injection in Desktop client

    The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of …

    Nextcloud security-advisories nextcloud-desktop nextcloud-desktop Debian Ubuntu Alpine
  • Medium 5.0
    CVE-2023-23943

    Blind SSRF via server URL input in the Nextcloud Mail app

    Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommend…

    Nextcloud security-advisories
  • Low 2.0
    CVE-2023-23944

    Nexcloud Mail app temporarily stores cleartext password in database

    Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the databa…

    Nextcloud security-advisories

Revision history

  1. #1

    Initiale Fassung

References