Medium severity · published Jan 18, 2024
CVE-2024-22213
Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users could be tricked into executing malicious code that would execute in their browser via HTML sent as a comment. It is recommended that the Nextcloud Deck is upgraded to version 1.9.5 or 1.11.2. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
security-advisories · nextcloud
>= 1.9.0, < 1.9.5; >= 1.10.0, < 1.11.2 · source: vendor
DE
Deck · Nextcloud
1.9.0 before 1.9.5; 1.10.0 before 1.11.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22213
Patch
https://github.com/nextcloud/deck/commit/91f1557362047f8840f53151f176b80148650bcd
Exploit
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mg7w-x9fm-9wwc
Exploit
https://hackerone.com/reports/2058556
More from security-advisories
9.8
CVE-2024-22212
Nextcloud global site selector authentication bypass
9.8
CVE-2023-49792
Bruteforce protection can be bypassed with misconfigured proxy
9.8
CVE-2023-48307
Nextcloud Mail app vulnerable to Server-Side Request Forgery
9.8
CVE-2023-48306
Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"