PT-2023-27172 · Nextcloud · Nextcloud Notes

0Xt4Req · Publicado 2023-08-10 · Atualizado 2023-08-16 · CVE-2023-39955

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Notes app versions 4.4.0 through 4.7.x

Description The issue occurs when creating a note file with HTML in the Nextcloud Notes app. Instead of offering the file for download, the content is rendered in the preview. This affects versions prior to 4.8.0. No known workarounds are available for this issue.

Recommendations For versions 4.4.0 through 4.7.x, update to version 4.8.0 to resolve the issue. At the moment, there is no information about other versions that contain a fix for this vulnerability.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-39955

GHSA-6G88-37X7-4VW6

Produtos afetados

Nextcloud Notes

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39955.json · Exploit
• https://github.com/nextcloud/notes/pull/1031 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6g88-37x7-4vw6 · Aviso do Fabricante
• https://hackerone.com/reports/1924355 · Nota
• https://osv.dev/vulnerability/CVE-2023-39955 · Aviso do Fabricante
• https://t.me/cvenotify/56656 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-39955 · Nota de Segurança
• https://t.me/cvenotify/56193 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1689683161163210761 · Publicação no Twitter
• https://t.me/cibsecurity/68221 · Publicação no Telegram