PT-2023-27172 · Nextcloud · Nextcloud Notes

0Xt4Req · Published 2023-08-10 · Updated 2023-08-16 · CVE-2023-39955

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Notes app versions 4.4.0 through 4.7.x

Description The issue occurs when creating a note file with HTML in the Nextcloud Notes app. Instead of offering the file for download, the content is rendered in the preview. This affects versions prior to 4.8.0. No known workarounds are available for this issue.

Recommendations For versions 4.4.0 through 4.7.x, update to version 4.8.0 to resolve the issue. At the moment, there is no information about other versions that contain a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-39955

GHSA-6G88-37X7-4VW6

Affected Products

Nextcloud Notes

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39955.json · Exploit
• https://github.com/nextcloud/notes/pull/1031 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6g88-37x7-4vw6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39955 · Security Note
• https://hackerone.com/reports/1924355 · Note
• https://t.me/cvenotify/56656 · Telegram Post
• https://t.me/cvenotify/56193 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1689683161163210761 · Twitter Post
• https://t.me/cibsecurity/68221 · Telegram Post