CVE-2021-39222
XSS in Talk
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Talk application is upgraded to patched versions 10.0.7, 10.1.4, 11.1.2, 11.2.0 or 12.0.0. As a workaround, use a browser that has support for Content-Security-Policy.
Nextcloud es una plataforma de productividad de código abierto y auto alojada. La aplicación Nextcloud Talk era susceptible a una vulnerabilidad de tipo Cross-Site Scripting (XSS) almacenada. Para una explotación, un usuario tendría que hacer clic con el botón derecho en un archivo malicioso y abrirlo en una nueva pestaña. Debido a la estricta política de seguridad de contenidos incluida en Nextcloud, este problema no es explotable en los navegadores modernos que soportan la política de seguridad de contenidos. Es recomendado actualizar la aplicación Nextcloud Talk a las versiones parcheadas 10.0.7, 10.1.4, 11.1.2, 11.2.0 o 12.0.0. Como solución, use un navegador que tenga soporte para Content-Security-Policy
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-08-16 CVE Reserved
- 2021-11-15 CVE Published
- 2024-07-31 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xhxq-f4vg-jw5g | Third Party Advisory | |
https://github.com/nextcloud/spreed/pull/542 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Nextcloud Search vendor "Nextcloud" | Talk Search vendor "Nextcloud" for product "Talk" | < 10.0.7 Search vendor "Nextcloud" for product "Talk" and version " < 10.0.7" | - |
Affected
| ||||||
Nextcloud Search vendor "Nextcloud" | Talk Search vendor "Nextcloud" for product "Talk" | >= 10.1.0 < 10.1.4 Search vendor "Nextcloud" for product "Talk" and version " >= 10.1.0 < 10.1.4" | - |
Affected
| ||||||
Nextcloud Search vendor "Nextcloud" | Talk Search vendor "Nextcloud" for product "Talk" | >= 11.0.0 < 11.1.2 Search vendor "Nextcloud" for product "Talk" and version " >= 11.0.0 < 11.1.2" | - |
Affected
|