CVE-2024-22213CWE-79

Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app

published January 18, 2024

CVSS v3.1
0.0
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users could be tricked into executing malicious code that would execute in their browser via HTML sent as a comment. It is recommended that the Nextcloud Deck is upgraded to version 1.9.5 or 1.11.2. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
0.0 · NONE
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00505 · 42.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-01-18T19:11Z
EPSS history
Timeline
  • 18 JAN 19:11Z
    Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app
    cvelistv5