CVE-2021-39221

Name of the Vulnerable Software and Affected Versions Nextcloud Contacts versions prior to 4.0.3

Description The Nextcloud Contacts application is vulnerable to a stored Cross-Site Scripting (XSS) issue. To exploit this, a user must right-click on a malicious file and open it in a new tab. However, due to the strict Content-Security-Policy in Nextcloud, this issue is not exploitable on modern browsers that support Content-Security-Policy.

Recommendations For versions prior to 4.0.3, upgrade the Nextcloud Contacts application to version 4.0.3. As a temporary workaround, consider using a browser that supports Content-Security-Policy to minimize the risk of exploitation.