CVE-2022-39331 Cross-site Scripting (XSS) in Nexcloud Desktop Client
An attacker can inject arbitrary HTML into the Nextcloud Desktop Client notifications, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-39331?
CVE-2022-39331 is a medium-severity cross-site scripting vulnerability in nextcloud security-advisories, published on 25 Nov 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.
Weakness: CWE-79
Which versions are affected by CVE-2022-39331?
It affects 1 product.
Products include Nextcloud Desktop.
How do I fix CVE-2022-39331?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-39331 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39331 exists.
Other vulnerabilities in nextcloud security-advisories
- CVE-2024-46958 Misconfiguration in n/a
- CVE-2020-8224 Code injection in Desktop Client
- CVE-2020-8225 Information disclosure in Desktop Client
- CVE-2021-37617 Untrusted Search Path in Nextcloud Desktop Client
- CVE-2023-28999 Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders
Sources
Also known as DEBIAN-CVE-2022-39331, GHSA-c3xh-q694-6rc5, UBUNTU-CVE-2022-39331.