CVE-2016-7419 Cross-site scripting in n/a
Authenticated users can inject arbitrary scripts via crafted directory names in the gallery application, potentially leading to session hijacking or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2016-7419?
CVE-2016-7419 is a medium-severity cross-site scripting vulnerability in Nextcloud Nextcloud Server, published on 17 Sep 2016. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.
Weakness: CWE-79
Which versions are affected by CVE-2016-7419?
It affects 2 products.
Products include Nextcloud Nextcloud Server, Owncloud Owncloud.
How do I fix CVE-2016-7419?
No fix has been published for CVE-2016-7419 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2016-7419 being exploited?
There is no known exploitation of CVE-2016-7419 in the wild and no public exploit code.
Other vulnerabilities in Nextcloud Nextcloud Server
- CVE-2021-32802 Preview generation used third-party library not suited for user-generated content in Nextcloud server
- CVE-2023-26482 Scope of workflow operations is not validated in nextcloud server
- CVE-2018-3775 Auth bypass in Nextcloud Server
- CVE-2023-35172 Nextcloud Server password reset endpoint is not brute force protected
- CVE-2023-32320 Nextcloud Server's brute force protection allows someone to send more requests than intended
Sources
Also known as GHSA-83x5-hc36-mfm2.