Main Vulnerability Database Vulnerabilities #VU46083

Cross-site scripting in desktop - CVE-2020-8189

Published: August 21, 2020 / Updated: August 27, 2020

Vulnerability identifier: #VU46083

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2020-8189

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated user to read and manipulate data.

A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.

Affected software

desktop
Gentoo Linux

How to mitigate CVE-2020-8189

Install update from vendor's website.

desktop - update to 2.6.5

External References

https://hackerone.com/reports/685552
https://nextcloud.com/security/advisory/?id=NC-SA-2020-027

Related Security Bulletins