Cross-site scripting in Nextcloud Server - CVE-2017-0891
Published: May 8, 2017 / Updated: July 18, 2020
Vulnerability identifier: #VU31419
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2017-0891
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to read and manipulate data.
Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components.
Affected software
Nextcloud Server
How to mitigate CVE-2017-0891
Install update from vendor's website.
Nextcloud Server - update to 11.0.3