CVE-2022-39332
Cross-site scripting (XSS) in Nextcloud Desktop Client
Summary
Cross-site scripting (XSS) in Nextcloud Desktop Client
Original description
The description as published by the source.
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-39332 nextcloud-desktop Fixed in: 3.1.1-2+deb11u2
- Ubuntu UBUNTU-CVE-2022-39332 nextcloud-desktop
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web hackerone.com
- web lists.debian.org