Cross-site Scripting (XSS) Affecting nextcloud-desktop package, versions <3.6.1-1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIANUNSTABLE-NEXTCLOUDDESKTOP-3152673
- published 2 Dec 2022
- disclosed 25 Nov 2022
Introduced: 25 Nov 2022
CVE-2022-39331 Open this link in a new tabHow to fix?
Upgrade Debian:unstable nextcloud-desktop to version 3.6.1-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream nextcloud-desktop package and not the nextcloud-desktop package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.