PT-2021-18214 · Nextcloud · @Nextcloud/Dialogs

Lukas Reschke · Published 2021-04-13 · Updated 2021-04-19 · CVE-2021-29438

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: @nextcloud/dialogs versions prior to 3.1.2

Description: The issue arises from insufficient escaping of text input passed to a toast in the Nextcloud dialogs library. This could lead to a XSS vulnerability if the application displays toasts with user-supplied input. Nextcloud Server has a strict Content Security Policy that mitigates the risk of these XSS vulnerabilities.

Recommendations: For versions prior to 3.1.2, update to version 3.1.2 to patch the vulnerability. If you need to display HTML in the toast, explicitly pass the options.isHTML config flag. As a temporary workaround, ensure no user-supplied input flows into toasts.

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2021-29438

GHSA-G3FQ-3V3G-MH32

Affected Products

@Nextcloud/Dialogs

References · 6

• https://osv.dev/vulnerability/CVE-2021-29438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29438 · Security Note
• https://osv.dev/vulnerability/GHSA-g3fq-3v3g-mh32 · Vendor Advisory
• https://github.com/nextcloud/nextcloud-dialogs/security/advisories/GHSA-g3fq-3v3g-mh32 · Note
• https://npmjs.com/package/%40nextcloud/dialogs · Note
• https://npmjs.com/package/@nextcloud/dialogs · Note