CVE-2019-15619
Global infos:
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
CVE Status: Modified
References:
Metrics:
| Attribute | Value |
|---|---|
| Attack Complexity | LOW |
| Attack Vector | NETWORK |
| Availability Impact | NONE |
| Base Score | 4.8 |
| Base Severity | MEDIUM |
| Confidentiality Impact | LOW |
| Integrity Impact | LOW |
| Privileges Required | HIGH |
| Scope | CHANGED |
| User Interaction | REQUIRED |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| Exploitability Score | 1.7 |
| Impact Score | 2.7 |
| Source | [email protected] |
| Type | Primary |