CVE-2023-39955 Notes attachment render HTML in preview mode

Low 3.5 Published 10 Aug 2023 Updated 4 Oct 2024

Attackers can execute arbitrary scripts via HTML in note attachments, potentially compromising user accounts in Nextcloud.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-39955?

CVE-2023-39955 is a low-severity cross-site scripting vulnerability in nextcloud security-advisories, published on 10 Aug 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Notes is a note-taking app for Nextcloud, an open-source cloud platform. Starting in version 4.4.0 and prior to version 4.8.0, when creating a note file with HTML, the content is rendered in the preview instead of the file being offered to download. Nextcloud Notes app version 4.8.0 contains a patch for the issue. No known workarounds are available.

Weakness: CWE-79

Which versions are affected by CVE-2023-39955?

It affects 1 product.

Products include Nextcloud Notes.

How do I fix CVE-2023-39955?

No fix has been published for CVE-2023-39955 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-39955 being exploited?

There is no known exploitation of CVE-2023-39955 in the wild and no public exploit code.

CVE-2024-37317 Nextcloud Notes app can be tricked into using a received share created before the user logged in Medium 4.6

Sources

Also known as GHSA-6g88-37x7-4vw6.