Cross-site Scripting (XSS) Affecting nextcloud-desktop package, versions <3.6.1-1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN13-NEXTCLOUDDESKTOP-5689785
- published 2 Dec 2022
- disclosed 25 Nov 2022
Introduced: 25 Nov 2022
CVE-2022-39332 Open this link in a new tabHow to fix?
Upgrade Debian:13 nextcloud-desktop to version 3.6.1-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream nextcloud-desktop package and not the nextcloud-desktop package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.