CVE-2018-3763

MEDIUM

4.8

Descricao

In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.

Detalhes CVE

Pontuacao CVSS v3.14.8

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosHIGH

Interacao do usuarioREQUIRED

Publicado7/5/2018

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

nextcloud:calendar

Fraquezas (CWE)

CWE-79CWE-79

Referencias

https://nextcloud.com/security/advisory/?id=nc-sa-2018-004(support@hackerone.com)

https://nextcloud.com/security/advisory/?id=nc-sa-2018-004(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.