CVE-2021-32782 Cross-Site Scripting in Nextcloud Circles
Stored XSS in Nextcloud Circles allows code execution in browsers lacking CSP support, such as Internet Explorer.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-32782?
CVE-2021-32782 is a medium-severity cross-site scripting vulnerability in nextcloud security-advisories, published on 7 Sep 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly.
Weakness: CWE-79
Which versions are affected by CVE-2021-32782?
It affects 1 product.
Products include Nextcloud Circles.
How do I fix CVE-2021-32782?
No fix has been published for CVE-2021-32782 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-32782 being exploited?
There is no known exploitation of CVE-2021-32782 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
Sources
Also known as GHSA-hgpq-28gj-jrj9.