PT-2024-19280 · Nextcloud · Nextcloud Deck

Hackitbharat · Published 2024-01-18 · Updated 2024-01-25 · CVE-2024-22213

Positive Technologies (AI Summary)

CVSS v3.1

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.9.5 Nextcloud Deck versions prior to 1.11.2

Description The issue allows users to be tricked into executing malicious code in their browser via HTML sent as a comment. This is a problem with the way the application handles comments, allowing for the execution of malicious HTML code.

Recommendations For versions prior to 1.9.5, upgrade to version 1.9.5 or later. For versions prior to 1.11.2, upgrade to version 1.11.2 or later. As a temporary workaround, consider restricting the use of HTML in comments until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-22213

GHSA-MG7W-X9FM-9WWC

Affected Products

Nextcloud Deck

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22213.json · Exploit
• 🔥 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mg7w-x9fm-9wwc · Exploit
• 🔥 https://hackerone.com/reports/2058556 · Exploit
• https://github.com/nextcloud/deck/commit/91f1557362047f8840f53151f176b80148650bcd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-22213 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22213 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1748097731749392797 · Twitter Post
• https://t.me/cvenotify/68672 · Telegram Post
• https://twitter.com/CVEnew/status/1748063633819468006 · Twitter Post