CVE-2023-48302

LOW

Nextcloud Server 25.0.0-25.0.12 - Stored Cross-Site Scripting via Paste Without Markup

Title source: llm

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTML code without markup (Ctrl+Shift+V) the markup will actually render. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3 contain a fix for this issue. As a workaround, disable app text.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p7g9-x25m-4h87

Patch x_refsource_misc

https://github.com/nextcloud/text/pull/4877

Permissions Required x_refsource_misc

https://hackerone.com/reports/2211561

Scores

CVSS v3 3.5

EPSS 0.0039

EPSS Percentile 59.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Details

CWE

CWE-79

Status published

Products (1)

nextcloud/nextcloud_server 25.0.0 - 25.0.13 (2 CPE variants)

Published Nov 21, 2023

Tracked Since Feb 18, 2026