CVE-2023-23942 Self reflected HTML injection in Desktop client

What is CVE-2023-23942?

CVE-2023-23942 is a medium-severity cross-site scripting vulnerability in nextcloud security-advisories, published on 6 Feb 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.

Weakness: CWE-79

Which versions are affected by CVE-2023-23942?

It affects 1 product.

Products include Nextcloud Desktop.

How do I fix CVE-2023-23942?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-23942 being exploited?

There is no known exploitation of CVE-2023-23942 in the wild and no public exploit code.

Other vulnerabilities in nextcloud security-advisories

• CVE-2024-46958 Misconfiguration in n/a Critical 9.1
• CVE-2020-8224 Code injection in Desktop Client High 7.8
• CVE-2020-8225 Information disclosure in Desktop Client High 7.5
• CVE-2021-37617 Untrusted Search Path in Nextcloud Desktop Client High 7.3
• CVE-2023-28999 Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-23942, GHSA-64qc-vf6v-8xgg, UBUNTU-CVE-2023-23942.