PT-2023-27172

CVE-2023-39955

Published

2023-08-10

Updated

2023-08-16

Description by

CVSS 3.1

3.5

Low

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Notes app versions 4.4.0 through 4.7.x

Description The issue occurs when creating a note file with HTML in the Nextcloud Notes app. Instead of offering the file for download, the content is rendered in the preview. This affects versions prior to 4.8.0. No known workarounds are available for this issue.

Recommendations For versions 4.4.0 through 4.7.x, update to version 4.8.0 to resolve the issue. At the moment, there is no information about other versions that contain a fix for this vulnerability.

Exploitability

Exploit

Fix

Impacts

Researchers

0Xt4Req

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2023-39955