Vulnerability · Published Sep 7, 2021 · Assigned by GitHub_M

CVE-2021-32782Cross-Site Scripting in Nextcloud Circles

Medium 5.8

In plain English

A medium-severity cross-site scripting in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.8%top 42.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 0.19.1>= 0.20.0, < 0.20.10>= 0.21.0, < 0.21.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hgpq-28gj-jrj9 x_refsource_CONFIRM
https://github.com/nextcloud/circles/commit/dbb97a83ccb342c839a54f088aa19b8ba6844b0e x_refsource_MISC
https://hackerone.com/reports/1217606 x_refsource_MISC