CVE-2021-32733

Name of the Vulnerable Software and Affected Versions Nextcloud Text versions prior to 19.0.13 Nextcloud Text versions prior to 20.0.11 Nextcloud Text versions prior to 21.0.3

Description A cross-site scripting issue is present in the Nextcloud Text application. The application uses a text/html Content-Type when serving files to users. However, due to the strict Content-Security-Policy, this issue is not exploitable on modern browsers that support Content-Security-Policy.

Recommendations For versions prior to 19.0.13, update to version 19.0.13 or later. For versions prior to 20.0.11, update to version 20.0.11 or later. For versions prior to 21.0.3, update to version 21.0.3 or later. As a temporary workaround, consider using a browser that supports Content-Security-Policy to minimize the risk of exploitation.