← Back

CVE-2023-48302

nvd nist
Published: Nov 21, 2023Modified: Jun 17, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.3 / Impact: 2.7
Source: NVD

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTML code without markup (Ctrl+Shift+V) the markup will actually render. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3 contain a fix for this issue. As a workaround, disable app text.

Affected (6)

Nextcloud
1 product
Nextcloud Server
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Nextcloud
Nextcloud Server
From 25.0.0 to 25.0.13
Nextcloud Server
From 26.0.0 to 26.0.8
Nextcloud Server
From 27.0.0 to 27.1.3
Nextcloud Server
From 25.0.0 to 25.0.13
Nextcloud Server
From 26.0.0 to 26.0.8
Nextcloud Server
From 27.0.0 to 27.1.3

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

Source: security-advisories@github.com
Vendor Advisory
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Permissions Required
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions Required

Timeline

No history available yet.