CVE-2020-8294 | BDVDB-2026-148442 Detail

Nextcloud Server

Description#

A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://hackerone.com/reports/1023787
https://nextcloud.com/security/advisory/?id=NC-SA-2021-002

Exploit#

No public exploit known

History#

Version 12021-02-03Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.